|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� � :Y�fB�P�:W.>>h2Z��g9�~�3����V ��2��ǧ�3�:kb$"�S`�z�/���tNV� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � :Y�fB�P�:W.>>h2Z��g9�~�3����V ��2��ǧ�3�:kb$"�S`�z�/���tNV� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� � :Y�fB�P�:W.>>h2Z��g9�~�3����V ��2��ǧ�3�:kb$"�S`�z�/���tNV� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 416,
"payload_entropy": 5.968355545359472,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eab0ab08734406ec61efc0947190e4d2",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001c:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\u0011\ufffd\ufffd\ufffd\ufffdV\u001c \ufffd\ufffd2\ufffd\ufffd\u0017\u01e7\ufffd\u000e3\ufffd:kb$\"\ufffdS`\ufffd\u001bz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001c:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\u0011\ufffd\ufffd\ufffd\ufffdV\u001c \ufffd\ufffd2\ufffd\ufffd\u0017\u01e7\ufffd\u000e3\ufffd:kb$\"\ufffdS`\ufffd\u001bz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001c:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\u0011\ufffd\ufffd\ufffd\ufffdV\u001c \ufffd\ufffd2\ufffd\ufffd\u0017\u01e7\ufffd\u000e3\ufffd:kb$\"\ufffdS`\ufffd\u001bz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df268d2da93220743c509830db884cf06ee8f5a1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001c:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\u0011\ufffd\ufffd\ufffd\ufffdV\u001c \ufffd\ufffd2\ufffd\ufffd\u0017\u01e7\ufffd\u000e3\ufffd:kb$\"\ufffdS`\ufffd\u001bz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\ufffd\ufffd\ufffd\ufffdV \ufffd\ufffd2\ufffd\ufffd\u01e7\ufffd3\ufffd:kb$\"\ufffdS`\ufffdz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001c:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\u0011\ufffd\ufffd\ufffd\ufffdV\u001c \ufffd\ufffd2\ufffd\ufffd\u0017\u01e7\ufffd\u000e3\ufffd:kb$\"\ufffdS`\ufffd\u001bz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd:Y\ufffdfB\ufffdP\ufffd:W.>>h2Z\ufffd\ufffdg9\ufffd~\ufffd3\ufffd\ufffd\ufffd\ufffdV \ufffd\ufffd2\ufffd\ufffd\u01e7\ufffd3\ufffd:kb$\"\ufffdS`\ufffdz\ufffd\/\ufffd\ufffd\ufffdtNV\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� ����P2�3& �~��I�`,���Y'�aD�k�� kD��|h�&��<����+�� e3�� �Pt �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����P2�3& �~��I�`,���Y'�aD�k�� kD��|h�&��<����+�� e3�� �Pt �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ����P2�3& �~��I�`,���Y'�aD�k�� kD��|h�&��<����+�� e3�� �Pt �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �:: 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 439,
"payload_entropy": 5.911695579818689,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7399fd747df800c95ef6619ac695d670",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0013\ufffdP2\ufffd3&\u001d\u0017\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\u0002\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd k\u0019D\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\u0019\ufffd+\ufffd\ufffd\u0000e3\ufffd\ufffd \u0001\ufffdPt\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0013\ufffdP2\ufffd3&\u001d\u0017\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\u0002\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd k\u0019D\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\u0019\ufffd+\ufffd\ufffd\u0000e3\ufffd\ufffd \u0001\ufffdPt\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd::\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0013\ufffdP2\ufffd3&\u001d\u0017\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\u0002\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd k\u0019D\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\u0019\ufffd+\ufffd\ufffd\u0000e3\ufffd\ufffd \u0001\ufffdPt\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26d76d8b0d6367fd058f7782c84cca20f2b27b4f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0013\ufffdP2\ufffd3&\u001d\u0017\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\u0002\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd k\u0019D\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\u0019\ufffd+\ufffd\ufffd\u0000e3\ufffd\ufffd \u0001\ufffdPt\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdP2\ufffd3&\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd kD\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffde3\ufffd\ufffd \ufffdPt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0013\ufffdP2\ufffd3&\u001d\u0017\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\u0002\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd k\u0019D\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\u0019\ufffd+\ufffd\ufffd\u0000e3\ufffd\ufffd \u0001\ufffdPt\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdP2\ufffd3&\ufffd~\ufffd\ufffdI\ufffd`,\ufffd\ufffd\ufffdY'\ufffdaD\ufffdk\ufffd\ufffd kD\ufffd\ufffd|h\ufffd&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffde3\ufffd\ufffd \ufffdPt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �7�uF�r����+�t���7=3�V���q�|�D�� N���,���d1��q{4+���I5��}���� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �7�uF�r����+�t���7=3�V���q�|�D�� N���,���d1��q{4+���I5��}���� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �7�uF�r����+�t���7=3�V���q�|�D�� N���,���d1��q{4+���I5��}���� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 426,
"payload_entropy": 5.969257564772651,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d99e8712870f382d1292d88d6f44f3c",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd \u0004N\ufffd\u0004\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffd\u0001q{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd \u0004N\ufffd\u0004\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffd\u0001q{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd \u0004N\ufffd\u0004\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffd\u0001q{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4e54ca220c0016de85c60d66aa62827775d0c21",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd \u0004N\ufffd\u0004\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffd\u0001q{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd7\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd N\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffdq{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd \u0004N\ufffd\u0004\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffd\u0001q{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd7\ufffduF\ufffdr\ufffd\ufffd\ufffd\ufffd+\ufffdt\ufffd\ufffd\ufffd7=3\ufffdV\ufffd\ufffd\ufffdq\ufffd|\ufffdD\ufffd\ufffd N\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdd1\ufffd\ufffdq{4+\ufffd\ufffd\ufffdI5\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �N�^|���>bS�u�5�<#��}樴w�YHgu� h� �@�j�֫�%*a[0���t="�F��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N�^|���>bS�u�5�<#��}樴w�YHgu� h� �@�j�֫�%*a[0���t="�F��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �N�^|���>bS�u�5�<#��}樴w�YHgu� h� �@�j�֫�%*a[0���t="�F��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 426,
"payload_entropy": 5.977729618039937,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eb46fdca0797bb736c29e65c516d0f9b",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\bN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdY\u0010Hgu\ufffd h\ufffd\b\u001d\ufffd@\u0013\ufffdj\u0004\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\u0019\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\bN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdY\u0010Hgu\ufffd h\ufffd\b\u001d\ufffd@\u0013\ufffdj\u0004\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\u0019\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\bN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdY\u0010Hgu\ufffd h\ufffd\b\u001d\ufffd@\u0013\ufffdj\u0004\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\u0019\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8f1f63f272df1088ecdb6b7ff0c01f696b1d24f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\bN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdY\u0010Hgu\ufffd h\ufffd\b\u001d\ufffd@\u0013\ufffdj\u0004\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\u0019\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffdN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdYHgu\ufffd h\ufffd\ufffd@\ufffdj\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\bN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdY\u0010Hgu\ufffd h\ufffd\b\u001d\ufffd@\u0013\ufffdj\u0004\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\u0019\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdN\ufffd^|\ufffd\ufffd\ufffd>bS\ufffdu\ufffd5\ufffd<#\ufffd\ufffd}\u6a34w\ufffdYHgu\ufffd h\ufffd\ufffd@\ufffdj\ufffd\u05ab\ufffd%*a[0\ufffd\ufffd\ufffdt=\"\ufffdF\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �^v��~�Ma�fAS� n��hv���U�=��� SZ����� a/�� b�j�Ȯ�O��6��7� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �^v��~�Ma�fAS� n��hv���U�=��� SZ����� a/�� b�j�Ȯ�O��6��7� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �^v��~�Ma�fAS� n��hv���U�=��� SZ����� a/�� b�j�Ȯ�O��6��7� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 413,
"payload_entropy": 6.019315240223746,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e4e2172c44084aa12dbff0670221ec82",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffd\u001en\ufffd\ufffdhv\ufffd\u0012\ufffd\u001a\ufffdU\ufffd=\ufffd\ufffd\ufffd\u0017\u0013 SZ\ufffd\u0007\ufffd\ufffd\ufffd\u0016\ufffd\fa\u0001\/\ufffd\ufffd\u001db\ufffdj\u0006\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffd\u001en\ufffd\ufffdhv\ufffd\u0012\ufffd\u001a\ufffdU\ufffd=\ufffd\ufffd\ufffd\u0017\u0013 SZ\ufffd\u0007\ufffd\ufffd\ufffd\u0016\ufffd\fa\u0001\/\ufffd\ufffd\u001db\ufffdj\u0006\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffd\u001en\ufffd\ufffdhv\ufffd\u0012\ufffd\u001a\ufffdU\ufffd=\ufffd\ufffd\ufffd\u0017\u0013 SZ\ufffd\u0007\ufffd\ufffd\ufffd\u0016\ufffd\fa\u0001\/\ufffd\ufffd\u001db\ufffdj\u0006\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f30121fa19bf2e1ad3b26993146afcaaf92b3389",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffd\u001en\ufffd\ufffdhv\ufffd\u0012\ufffd\u001a\ufffdU\ufffd=\ufffd\ufffd\ufffd\u0017\u0013 SZ\ufffd\u0007\ufffd\ufffd\ufffd\u0016\ufffd\fa\u0001\/\ufffd\ufffd\u001db\ufffdj\u0006\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffdn\ufffd\ufffdhv\ufffd\ufffd\ufffdU\ufffd=\ufffd\ufffd\ufffd SZ\ufffd\ufffd\ufffd\ufffd\ufffda\/\ufffd\ufffdb\ufffdj\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffd\u001en\ufffd\ufffdhv\ufffd\u0012\ufffd\u001a\ufffdU\ufffd=\ufffd\ufffd\ufffd\u0017\u0013 SZ\ufffd\u0007\ufffd\ufffd\ufffd\u0016\ufffd\fa\u0001\/\ufffd\ufffd\u001db\ufffdj\u0006\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd^v\ufffd\ufffd~\ufffdMa\ufffdfAS\ufffdn\ufffd\ufffdhv\ufffd\ufffd\ufffdU\ufffd=\ufffd\ufffd\ufffd SZ\ufffd\ufffd\ufffd\ufffd\ufffda\/\ufffd\ufffdb\ufffdj\ufffd\u022e\ufffdO\ufffd\ufffd6\ufffd\ufffd7\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
F BMq�j� y͢ o�^B���LKhҌ�en� �(� �|�~'�u��ķ� ���Rp0�Mύ f�`�{s D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F BMq�j� y͢ o�^B���LKhҌ�en� �(� �|�~'�u��ķ� ���Rp0�Mύ f�`�{s D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F BMq�j� y͢ o�^B���LKhҌ�en� �(� �|�~'�u��ķ� ���Rp0�Mύ f�`�{s D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 331,
"payload_entropy": 6.0139266193987115,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0de9d91016f781660556b6d30ba0f273",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53badd7a042a37a0d1658e6ced82b71317acdfc7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "FBMq\ufffdj\ufffdy\u0362o\ufffd^B\ufffd\ufffd\ufffdLKh\u048c\ufffden\ufffd\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\ufffd\u0137\ufffd\ufffd\ufffd\ufffdRp0\ufffdM\u03cdf\ufffd`\ufffd{sD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003Mq\ufffdj\ufffd\u001dy\u0362\fo\ufffd^B\ufffd\ufffd\ufffdLK\u0007h\u048c\ufffden\ufffd\u001f\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\u0013\ufffd\u0137\ufffd\u001d\ufffd\ufffd\ufffdRp0\ufffdM\u03cd\u001ef\ufffd`\ufffd\u000e{s\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FBMq\ufffdj\ufffdy\u0362o\ufffd^B\ufffd\ufffd\ufffdLKh\u048c\ufffden\ufffd\ufffd(\ufffd \ufffd|\ufffd~'\ufffdu\ufffd\ufffd\u0137\ufffd\ufffd\ufffd\ufffdRp0\ufffdM\u03cdf\ufffd`\ufffd{sD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �F��o�V��8� �{Ҟ�F6 C��N�!m � ��[J<�1Z��Z0{� �^�������{��d� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �F��o�V��8� �{Ҟ�F6 C��N�!m � ��[J<�1Z��Z0{� �^�������{��d� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �F��o�V��8� �{Ҟ�F6 C��N�!m � ��[J<�1Z��Z0{� �^�������{��d� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �ZZ 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 412,
"payload_entropy": 5.990887447557374,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2c91a0b1a1a3909c8815eea909b68432",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003F\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\u001d\ufffd{\u049e\ufffd\u0010\u0014F6\u001eC\ufffd\ufffdN\ufffd!m\u001d\ufffd \ufffd\u0019\ufffd[J\u0001<\ufffd1Z\ufffd\ufffdZ0{\ufffd\u001d\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003F\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\u001d\ufffd{\u049e\ufffd\u0010\u0014F6\u001eC\ufffd\ufffdN\ufffd!m\u001d\ufffd \ufffd\u0019\ufffd[J\u0001<\ufffd1Z\ufffd\ufffdZ0{\ufffd\u001d\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdZZ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003F\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\u001d\ufffd{\u049e\ufffd\u0010\u0014F6\u001eC\ufffd\ufffdN\ufffd!m\u001d\ufffd \ufffd\u0019\ufffd[J\u0001<\ufffd1Z\ufffd\ufffdZ0{\ufffd\u001d\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a67a86017317753fc6bd6b8ef86667d8cfab86a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003F\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\u001d\ufffd{\u049e\ufffd\u0010\u0014F6\u001eC\ufffd\ufffdN\ufffd!m\u001d\ufffd \ufffd\u0019\ufffd[J\u0001<\ufffd1Z\ufffd\ufffdZ0{\ufffd\u001d\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffdF\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\ufffd{\u049e\ufffdF6C\ufffd\ufffdN\ufffd!m\ufffd \ufffd\ufffd[J<\ufffd1Z\ufffd\ufffdZ0{\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003F\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\u001d\ufffd{\u049e\ufffd\u0010\u0014F6\u001eC\ufffd\ufffdN\ufffd!m\u001d\ufffd \ufffd\u0019\ufffd[J\u0001<\ufffd1Z\ufffd\ufffdZ0{\ufffd\u001d\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdF\ufffd\ufffdo\ufffdV\ufffd\ufffd8\ufffd\ufffd{\u049e\ufffdF6C\ufffd\ufffdN\ufffd!m\ufffd \ufffd\ufffd[J<\ufffd1Z\ufffd\ufffdZ0{\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
T P�&_ x�*�zO@-�]�դ�R��,� ��� 0�%�� c��l��9Ͼ�dH��I �a���� F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P�&_ x�*�zO@-�]�դ�R��,� ��� 0�%�� c��l��9Ͼ�dH��I �a���� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P�&_ x�*�zO@-�]�դ�R��,� ��� 0�%�� c��l��9Ͼ�dH��I �a���� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 345,
"payload_entropy": 6.097606209779853,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c55868bc3e41bbcfd0d4e34142833627",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd&_\u001cx\ufffd*\ufffdzO@-\ufffd]\ufffd\u0001\u0564\ufffdR\ufffd\ufffd\u0005,\ufffd\u0005\u001e\f\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffd\u001dc\ufffd\u0016\ufffdl\u0004\ufffd\ufffd9\u0019\u03fe\ufffddH\ufffd\u0010\ufffdI\u001f\ufffda\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd&_\u001cx\ufffd*\ufffdzO@-\ufffd]\ufffd\u0001\u0564\ufffdR\ufffd\ufffd\u0005,\ufffd\u0005\u001e\f\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffd\u001dc\ufffd\u0016\ufffdl\u0004\ufffd\ufffd9\u0019\u03fe\ufffddH\ufffd\u0010\ufffdI\u001f\ufffda\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd&_\u001cx\ufffd*\ufffdzO@-\ufffd]\ufffd\u0001\u0564\ufffdR\ufffd\ufffd\u0005,\ufffd\u0005\u001e\f\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffd\u001dc\ufffd\u0016\ufffdl\u0004\ufffd\ufffd9\u0019\u03fe\ufffddH\ufffd\u0010\ufffdI\u001f\ufffda\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a045a6440bb6c942b1bb9d8060df07d248291f4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd&_\u001cx\ufffd*\ufffdzO@-\ufffd]\ufffd\u0001\u0564\ufffdR\ufffd\ufffd\u0005,\ufffd\u0005\u001e\f\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffd\u001dc\ufffd\u0016\ufffdl\u0004\ufffd\ufffd9\u0019\u03fe\ufffddH\ufffd\u0010\ufffdI\u001f\ufffda\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "TP\ufffd&_x\ufffd*\ufffdzO@-\ufffd]\ufffd\u0564\ufffdR\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffdc\ufffd\ufffdl\ufffd\ufffd9\u03fe\ufffddH\ufffd\ufffdI\ufffda\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd&_\u001cx\ufffd*\ufffdzO@-\ufffd]\ufffd\u0001\u0564\ufffdR\ufffd\ufffd\u0005,\ufffd\u0005\u001e\f\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffd\u001dc\ufffd\u0016\ufffdl\u0004\ufffd\ufffd9\u0019\u03fe\ufffddH\ufffd\u0010\ufffdI\u001f\ufffda\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd&_x\ufffd*\ufffdzO@-\ufffd]\ufffd\u0564\ufffdR\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd 0\ufffd%\ufffd\ufffdc\ufffd\ufffdl\ufffd\ufffd9\u03fe\ufffddH\ufffd\ufffdI\ufffda\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �X�x�~ @K%��D��D�����Z��P� �y�� �n�az�=��s���-����Mz�߆Q y��y� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �X�x�~ @K%��D��D�����Z��P� �y�� �n�az�=��s���-����Mz�߆Q
y��y� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �X�x�~ @K%��D��D�����Z��P� �y�� �n�az�=��s���-����Mz�߆Q y��y� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 424,
"payload_entropy": 6.001401992662191,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "567fc904ebb724a18ffcc3f49c7ac4c8",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdx\ufffd~\u000b@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\b\ufffdP\ufffd \ufffdy\u0015\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\u0010\ufffd\ufffdy\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdx\ufffd~\u000b@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\b\ufffdP\ufffd \ufffdy\u0015\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\u0010\ufffd\ufffdy\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdx\ufffd~\u000b@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\b\ufffdP\ufffd \ufffdy\u0015\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\u0010\ufffd\ufffdy\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1598ac2660b5acd88efa060587f2fe11886b823a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdx\ufffd~\u000b@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\b\ufffdP\ufffd \ufffdy\u0015\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\u0010\ufffd\ufffdy\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffdX\ufffdx\ufffd~@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\ufffdP\ufffd \ufffdy\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdx\ufffd~\u000b@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\b\ufffdP\ufffd \ufffdy\u0015\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\u0010\ufffd\ufffdy\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdX\ufffdx\ufffd~@K%\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffd\ufffdP\ufffd \ufffdy\ufffd\ufffd \ufffdn\ufffdaz\ufffd=\ufffd\ufffds\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffdMz\ufffd\u07c6Q\ry\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �@�/� �>'4�y��E���s¶�#�r1�o4.� �!�$�8H$X��i��� ?����5L� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �@�/� �>'4�y��E���s¶�#�r1�o4.� �!�$�8H$X��i��� ?����5L� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �@�/� �>'4�y��E���s¶�#�r1�o4.� �!�$�8H$X��i��� ?����5L� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 424,
"payload_entropy": 5.99101797123788,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e727ce378430ea97b87b51473996650b",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003@\u0010\ufffd\/\ufffd\u0000\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffd\u0018o4.\ufffd \ufffd!\ufffd$\ufffd8\u001aH$X\ufffd\ufffdi\ufffd\ufffd\u0004\ufffd\u000e\u001e\u0018?\ufffd\ufffd\u0006\ufffd\ufffd5L\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003@\u0010\ufffd\/\ufffd\u0000\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffd\u0018o4.\ufffd \ufffd!\ufffd$\ufffd8\u001aH$X\ufffd\ufffdi\ufffd\ufffd\u0004\ufffd\u000e\u001e\u0018?\ufffd\ufffd\u0006\ufffd\ufffd5L\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003@\u0010\ufffd\/\ufffd\u0000\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffd\u0018o4.\ufffd \ufffd!\ufffd$\ufffd8\u001aH$X\ufffd\ufffdi\ufffd\ufffd\u0004\ufffd\u000e\u001e\u0018?\ufffd\ufffd\u0006\ufffd\ufffd5L\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0be11457d3d482cf8fea2251552cba1ebdab4303",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003@\u0010\ufffd\/\ufffd\u0000\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffd\u0018o4.\ufffd \ufffd!\ufffd$\ufffd8\u001aH$X\ufffd\ufffdi\ufffd\ufffd\u0004\ufffd\u000e\u001e\u0018?\ufffd\ufffd\u0006\ufffd\ufffd5L\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd@\ufffd\/\ufffd\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffdo4.\ufffd \ufffd!\ufffd$\ufffd8H$X\ufffd\ufffdi\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd5L\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003@\u0010\ufffd\/\ufffd\u0000\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffd\u0018o4.\ufffd \ufffd!\ufffd$\ufffd8\u001aH$X\ufffd\ufffdi\ufffd\ufffd\u0004\ufffd\u000e\u001e\u0018?\ufffd\ufffd\u0006\ufffd\ufffd5L\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd@\ufffd\/\ufffd\ufffd>'4\ufffdy\ufffd\ufffdE\ufffd\ufffd\ufffds\u00b6\ufffd#\ufffdr1\ufffdo4.\ufffd \ufffd!\ufffd$\ufffd8H$X\ufffd\ufffdi\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd5L\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� ��;Ev��*�ʨ ����T�9ֱ�V�� �7T+m��MW0^�ʴx�ӣ����k��Ue�x� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��;Ev��*�ʨ ����T�9ֱ�V��
�7T+m��MW0^�ʴx�ӣ����k��Ue�x� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
� ��;Ev��*�ʨ ����T�9ֱ�V�� �7T+m��MW0^�ʴx�ӣ����k��Ue�x� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 517,
"payload_entropy": 3.924357403062681,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "baec7adc255890096cb64091b30d8212",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011 \ufffd\ufffd;Ev\ufffd\ufffd*\u001b\ufffd\u02a8\u001f\u0016\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdM\u0010W0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\u001b\ufffdx\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011 \ufffd\ufffd;Ev\ufffd\ufffd*\u001b\ufffd\u02a8\u001f\u0016\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdM\u0010W0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\u001b\ufffdx\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011 \ufffd\ufffd;Ev\ufffd\ufffd*\u001b\ufffd\u02a8\u001f\u0016\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdM\u0010W0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\u001b\ufffdx\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "873fd723ded6faf7be623885e072f02623382d5d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011 \ufffd\ufffd;Ev\ufffd\ufffd*\u001b\ufffd\u02a8\u001f\u0016\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdM\u0010W0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\u001b\ufffdx\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd \ufffd\ufffd;Ev\ufffd\ufffd*\ufffd\u02a8\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdMW0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\ufffdx\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0011 \ufffd\ufffd;Ev\ufffd\ufffd*\u001b\ufffd\u02a8\u001f\u0016\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdM\u0010W0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\u001b\ufffdx\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd \ufffd\ufffd;Ev\ufffd\ufffd*\ufffd\u02a8\ufffd\ufffd\ufffd\ufffdT\ufffd9\u05b1\ufffdV\ufffd\ufffd\n \ufffd7T+m\ufffd\ufffdMW0^\ufffd\u02b4x\ufffd\u04e3\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdUe\ufffdx\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|