|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
T P���fľ���Dy+�C�K#�� ���n�g�^ ;��|!�W4��%+��t�D�� E?nՠ * F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P���fľ���Dy+�C�K#�� ���n�g�^ ;��|!�W4��%+��t�D�� E?nՠ * F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P���fľ���Dy+�C�K#�� ���n�g�^ ;��|!�W4��%+��t�D�� E?nՠ * F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 345,
"payload_entropy": 6.10872633798622,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f1261e4e6c613af944457f0ca98d6cf",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f9e764324c8b92fc24c505f1cf38f4f1f6f6e9c3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "TP\ufffd\ufffd\ufffdf\u013e\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffdE?n\u0560*F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdf\u013e\u0007\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\u001e\ufffd\u000f\ufffd\ufffd\u0004n\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffd\u001c\bE?\u0010n\u0560\u000b*\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd\ufffd\ufffdf\u013e\ufffd\ufffd\ufffdDy+\ufffdC\ufffdK#\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdg\ufffd^ ;\ue95b\ufffd\ufffd|!\ufffdW4\ufffd\ufffd%+\ufffd\ufffdt\ufffdD\ufffd\ufffdE?n\u0560*F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
F B�1����v{��Sf�&���i�ݔ�S��D� ��w��*F�mKBl��!��� ҥN�2]-f/�! D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�1����v{��Sf�&���i�ݔ�S��D� ��w��*F�mKBl��!��� ҥN�2]-f/�! D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�1����v{��Sf�&���i�ݔ�S��D� ��w��*F�mKBl��!��� ҥN�2]-f/�! D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 331,
"payload_entropy": 5.984091231443628,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c40806133e6b999c11ca2fcbf6146670",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ca4869768bc264efcebd33942e84f673e27722b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "FB\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u04a5N\ufffd2]-f\/\ufffd!D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\u0010\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*\u0010F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u001e\u04a5N\ufffd2]-f\/\ufffd!\u0000\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffd1\ud88e\udf48\ufffd\ufffd\ufffd\ufffdv{\ufffd\ufffdSf\ufffd&\ufffd\ufffd\ufffdi\ufffd\u0754\ufffdS\ufffd\ufffdD\ufffd \ufffd\ufffdw\ufffd\ufffd*F\ufffdmKBl\ufffd\ufffd!\ufffd\ufffd\ufffd\u04a5N\ufffd2]-f\/\ufffd!D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �$O��a� ��E��q� `/N��0�'k �� ���p�Y� �V�����;�=���K2 � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �$O��a� ��E��q� `/N��0�'k �� ���p�Y� �V�����;�=���K2 � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �$O��a� ��E��q� `/N��0�'k �� ���p�Y� �V�����;�=���K2 � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 424,
"payload_entropy": 5.9394156190231335,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "683121774f70b4b68b441207d3598c2c",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003$O\u001b\u000f\ufffd\ufffda\ufffd\u000b\u0011\ufffd\ufffdE\ufffd\ufffdq\ufffd\u001d`\/N\ufffd\ufffd0\u0001\ufffd'k\u001c\ufffd\ufffd\f \ufffd\ufffd\u000f\u0005\ufffdp\ufffdY\ufffd\u0000\ufffdV\u000e\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\u0005\ufffd\ufffd\ufffdK2\u001f\u0015\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003$O\u001b\u000f\ufffd\ufffda\ufffd\u000b\u0011\ufffd\ufffdE\ufffd\ufffdq\ufffd\u001d`\/N\ufffd\ufffd0\u0001\ufffd'k\u001c\ufffd\ufffd\f \ufffd\ufffd\u000f\u0005\ufffdp\ufffdY\ufffd\u0000\ufffdV\u000e\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\u0005\ufffd\ufffd\ufffdK2\u001f\u0015\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003$O\u001b\u000f\ufffd\ufffda\ufffd\u000b\u0011\ufffd\ufffdE\ufffd\ufffdq\ufffd\u001d`\/N\ufffd\ufffd0\u0001\ufffd'k\u001c\ufffd\ufffd\f \ufffd\ufffd\u000f\u0005\ufffdp\ufffdY\ufffd\u0000\ufffdV\u000e\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\u0005\ufffd\ufffd\ufffdK2\u001f\u0015\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cafeb3557c8480c42e2a818e8691c70e0c7855fa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003$O\u001b\u000f\ufffd\ufffda\ufffd\u000b\u0011\ufffd\ufffdE\ufffd\ufffdq\ufffd\u001d`\/N\ufffd\ufffd0\u0001\ufffd'k\u001c\ufffd\ufffd\f \ufffd\ufffd\u000f\u0005\ufffdp\ufffdY\ufffd\u0000\ufffdV\u000e\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\u0005\ufffd\ufffd\ufffdK2\u001f\u0015\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd$O\ufffd\ufffda\ufffd\ufffd\ufffdE\ufffd\ufffdq\ufffd`\/N\ufffd\ufffd0\ufffd'k\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffdY\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\ufffd\ufffd\ufffdK2\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003$O\u001b\u000f\ufffd\ufffda\ufffd\u000b\u0011\ufffd\ufffdE\ufffd\ufffdq\ufffd\u001d`\/N\ufffd\ufffd0\u0001\ufffd'k\u001c\ufffd\ufffd\f \ufffd\ufffd\u000f\u0005\ufffdp\ufffdY\ufffd\u0000\ufffdV\u000e\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\u0005\ufffd\ufffd\ufffdK2\u001f\u0015\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd$O\ufffd\ufffda\ufffd\ufffd\ufffdE\ufffd\ufffdq\ufffd`\/N\ufffd\ufffd0\ufffd'k\ufffd\ufffd \ufffd\ufffd\ufffdp\ufffdY\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd=\ufffd\ufffd\ufffdK2\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� ��Dod�2=�{c=����������z�G�|jU 5�$I�Յ��jewt1gݺ _�5G����o�M0 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Dod�2=�{c=����������z�G�|jU 5�$I�Յ��jewt1gݺ _�5G����o�M0 � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��Dod�2=�{c=����������z�G�|jU 5�$I�Յ��jewt1gݺ _�5G����o�M0 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 424,
"payload_entropy": 5.98470593208581,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3797f3a735e60a72a2f6b0cc2cb901ad",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdDod\b\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|\u0018jU \u00065\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a\u000b_\ufffd5G\ufffd\ufffd\u0013\ufffd\ufffdo\ufffdM0\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdDod\b\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|\u0018jU \u00065\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a\u000b_\ufffd5G\ufffd\ufffd\u0013\ufffd\ufffdo\ufffdM0\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdDod\b\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|\u0018jU \u00065\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a\u000b_\ufffd5G\ufffd\ufffd\u0013\ufffd\ufffdo\ufffdM0\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7de16d093a2efccf4ef2ae5703d6e689c1a0835",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdDod\b\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|\u0018jU \u00065\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a\u000b_\ufffd5G\ufffd\ufffd\u0013\ufffd\ufffdo\ufffdM0\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd\ufffdDod\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|jU 5\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a_\ufffd5G\ufffd\ufffd\ufffd\ufffdo\ufffdM0\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdDod\b\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|\u0018jU \u00065\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a\u000b_\ufffd5G\ufffd\ufffd\u0013\ufffd\ufffdo\ufffdM0\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdDod\ufffd2=\ufffd{c=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdG\ufffd|jU 5\ufffd$I\ufffd\u0545\ufffd\ufffdjewt1g\u077a_\ufffd5G\ufffd\ufffd\ufffd\ufffdo\ufffdM0\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
��::;h����Au-z��1�j����4�,o) � R�^r��4V)��ݲ �] ��~PN �z:� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��::;h����Au-z��1�j����4�,o)
� R�^r��4V)��ݲ
�]
��~PN �z:� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��::;h����Au-z��1�j����4�,o) � R�^r��4V)��ݲ �] ��~PN �z:� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 517,
"payload_entropy": 3.9110236248020573,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d3f0ecf18056f8a342c410cf9e249d5",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd::;h\ufffd\ufffd\ufffd\ufffd\u0001Au-z\ufffd\ufffd1\ufffdj\ufffd\u0003\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\u0019\ufffd\ufffd\u00014V\u0016)\ufffd\u000e\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd::;h\ufffd\ufffd\ufffd\ufffd\u0001Au-z\ufffd\ufffd1\ufffdj\ufffd\u0003\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\u0019\ufffd\ufffd\u00014V\u0016)\ufffd\u000e\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd::;h\ufffd\ufffd\ufffd\ufffd\u0001Au-z\ufffd\ufffd1\ufffdj\ufffd\u0003\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\u0019\ufffd\ufffd\u00014V\u0016)\ufffd\u000e\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93258541bd185506df36fbe40e316c96ebaa4647",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd::;h\ufffd\ufffd\ufffd\ufffd\u0001Au-z\ufffd\ufffd1\ufffdj\ufffd\u0003\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\u0019\ufffd\ufffd\u00014V\u0016)\ufffd\u000e\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd::;h\ufffd\ufffd\ufffd\ufffdAu-z\ufffd\ufffd1\ufffdj\ufffd\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\ufffd\ufffd4V)\ufffd\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd::;h\ufffd\ufffd\ufffd\ufffd\u0001Au-z\ufffd\ufffd1\ufffdj\ufffd\u0003\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\u0019\ufffd\ufffd\u00014V\u0016)\ufffd\u000e\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd::;h\ufffd\ufffd\ufffd\ufffdAu-z\ufffd\ufffd1\ufffdj\ufffd\ufffd\ufffd\ufffd4\ufffd,o)\r\ufffd R\ufffd^r\ufffd\ufffd4V)\ufffd\ufffd\u0772\r\ufffd]\n\ufffd\ufffd~PN \ufffdz:\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �˛b�ч؊= f9y �%Z���ܶɿh �Z� �w/���w��/؞*��u���Pi糖_ � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �˛b�ч؊=
f9y
�%Z���ܶɿh
�Z�
�w/���w��/؞*��u���Pi糖_ � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �˛b�ч؊= f9y �%Z���ܶɿh �Z� �w/���w��/؞*��u���Pi糖_ � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 426,
"payload_entropy": 5.983619380708585,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7ec4dcaf01f9a5d143d269145146abe4",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u02dbb\ufffd\u0447\u060a=\rf\u00119y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd\f \n\ufffdw\/\ufffd\u0002\ufffd\u0017\ufffdw\ufffd\b\ufffd\u0013\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u0012\u7cd6_\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u02dbb\ufffd\u0447\u060a=\rf\u00119y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd\f \n\ufffdw\/\ufffd\u0002\ufffd\u0017\ufffdw\ufffd\b\ufffd\u0013\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u0012\u7cd6_\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u02dbb\ufffd\u0447\u060a=\rf\u00119y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd\f \n\ufffdw\/\ufffd\u0002\ufffd\u0017\ufffdw\ufffd\b\ufffd\u0013\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u0012\u7cd6_\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d13a7822027e15a0997bfa5cc7cdbb11277ff97b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u02dbb\ufffd\u0447\u060a=\rf\u00119y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd\f \n\ufffdw\/\ufffd\u0002\ufffd\u0017\ufffdw\ufffd\b\ufffd\u0013\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u0012\u7cd6_\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd\u02dbb\ufffd\u0447\u060a=\rf9y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd \n\ufffdw\/\ufffd\ufffd\ufffdw\ufffd\ufffd\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u7cd6_\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u02dbb\ufffd\u0447\u060a=\rf\u00119y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd\f \n\ufffdw\/\ufffd\u0002\ufffd\u0017\ufffdw\ufffd\b\ufffd\u0013\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u0012\u7cd6_\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u02dbb\ufffd\u0447\u060a=\rf9y\n\ufffd%Z\ufffd\ufffd\ufffd\u0736\u027fh\r\ufffdZ\ufffd \n\ufffdw\/\ufffd\ufffd\ufffdw\ufffd\ufffd\/\u061e*\ufffd\ufffdu\ufffd\ufffd\ufffdPi\u7cd6_\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� ��0F�Xv��-l�e���<\s�����~�k��/ } 瞎ĊP���! �;�q �W�s�)x���'�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��0F�Xv��-l�e���<\s�����~�k��/
} 瞎ĊP���! �;�q �W�s�)x���'�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��0F�Xv��-l�e���<\s�����~�k��/ } 瞎ĊP���! �;�q �W�s�)x���'�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 426,
"payload_entropy": 5.980027552943394,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "262d4c0e1337b5fed7950f49d3ed8bc4",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd\b~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq\u001c \ufffdW\u0007\ufffds\ufffd)x\u0002\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd\b~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq\u001c \ufffdW\u0007\ufffds\ufffd)x\u0002\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd\b~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq\u001c \ufffdW\u0007\ufffds\ufffd)x\u0002\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "343e4d1a14e1fbb94b4a55a8aa1dbf174f427a9a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd\b~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq\u001c \ufffdW\u0007\ufffds\ufffd)x\u0002\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq \ufffdW\ufffds\ufffd)x\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd\b~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq\u001c \ufffdW\u0007\ufffds\ufffd)x\u0002\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd0F\ufffdXv\ufffd\ufffd-l\ufffde\ufffd\ufffd\ufffd<\\s\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdk\ufffd\ufffd\/\r} \u778e\u010aP\ufffd\ufffd\ufffd!\t\ufffd;\ufffdq \ufffdW\ufffds\ufffd)x\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� ��4�����y2x1�ь� -�Cr�5"��/�( ���e!߾$�iM&ӿ���"lj����58� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��4�����y2x1�ь�
-�Cr�5"��/�( ���e!߾$�iM&ӿ���"lj����58� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��4�����y2x1�ь� -�Cr�5"��/�( ���e!߾$�iM&ӿ���"lj����58� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 413,
"payload_entropy": 6.027665465652535,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5b101459f1921d93e6c4aa37587bfac0",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0017\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffd\u001a\u001bCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u0019\u04ff\u0007\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0017\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffd\u001a\u001bCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u0019\u04ff\u0007\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0017\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffd\u001a\u001bCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u0019\u04ff\u0007\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afa375c08f2e678e5bb6f01d52323f07e0635c28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0017\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffd\u001a\u001bCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u0019\u04ff\u0007\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffdCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u04ff\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\u0017\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffd\u001a\u001bCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u0019\u04ff\u0007\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffdy2x1\ufffd\u044c\ufffd\n-\ufffdCr\ufffd5\"\ufffd\ufffd\/\ufffd( \ufffd\ufffd\ufffde!\u07fe$\ufffdiM&\u04ff\ufffd\ufffd\ufffd\"lj\ufffd\ufffd\ufffd\ufffd58\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �>�p�L�^�֔ZW� ��~��9 � &�t���x�`��[q-B����R7G��˯ �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �>�p�L�^�֔ZW� ��~��9 � &�t���x�`��[q-B����R7G��˯ �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �>�p�L�^�֔ZW� ��~��9 � &�t���x�`��[q-B����R7G��˯ �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �ZZ 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 412,
"payload_entropy": 5.9983809056730655,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca03e57b383abfaf1081b1fd08de001",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003>\u000f\ufffdp\ufffd\u0007L\u0018\ufffd^\u07b2\ufffd\u0594ZW\ufffd\u001d\u000f\ufffd\u001b\ufffd~\ufffd\ufffd9\t\u000f\u0005\ufffd\u001a &\ufffdt\u0005\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-\u0003B\ufffd\ufffd\ufffd\ufffd\u001aR7G\ufffd\ufffd\u02ef\u0002\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003>\u000f\ufffdp\ufffd\u0007L\u0018\ufffd^\u07b2\ufffd\u0594ZW\ufffd\u001d\u000f\ufffd\u001b\ufffd~\ufffd\ufffd9\t\u000f\u0005\ufffd\u001a &\ufffdt\u0005\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-\u0003B\ufffd\ufffd\ufffd\ufffd\u001aR7G\ufffd\ufffd\u02ef\u0002\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdZZ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003>\u000f\ufffdp\ufffd\u0007L\u0018\ufffd^\u07b2\ufffd\u0594ZW\ufffd\u001d\u000f\ufffd\u001b\ufffd~\ufffd\ufffd9\t\u000f\u0005\ufffd\u001a &\ufffdt\u0005\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-\u0003B\ufffd\ufffd\ufffd\ufffd\u001aR7G\ufffd\ufffd\u02ef\u0002\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "562819a71fadfddd90b3c2d080bd00dbc58d8f2d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003>\u000f\ufffdp\ufffd\u0007L\u0018\ufffd^\u07b2\ufffd\u0594ZW\ufffd\u001d\u000f\ufffd\u001b\ufffd~\ufffd\ufffd9\t\u000f\u0005\ufffd\u001a &\ufffdt\u0005\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-\u0003B\ufffd\ufffd\ufffd\ufffd\u001aR7G\ufffd\ufffd\u02ef\u0002\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd>\ufffdp\ufffdL\ufffd^\u07b2\ufffd\u0594ZW\ufffd\ufffd\ufffd~\ufffd\ufffd9\t\ufffd &\ufffdt\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-B\ufffd\ufffd\ufffd\ufffdR7G\ufffd\ufffd\u02ef\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003>\u000f\ufffdp\ufffd\u0007L\u0018\ufffd^\u07b2\ufffd\u0594ZW\ufffd\u001d\u000f\ufffd\u001b\ufffd~\ufffd\ufffd9\t\u000f\u0005\ufffd\u001a &\ufffdt\u0005\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-\u0003B\ufffd\ufffd\ufffd\ufffd\u001aR7G\ufffd\ufffd\u02ef\u0002\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd>\ufffdp\ufffdL\ufffd^\u07b2\ufffd\u0594ZW\ufffd\ufffd\ufffd~\ufffd\ufffd9\t\ufffd &\ufffdt\ufffd\ufffd\u07bc\ufffdx\ufffd`\ufffd\ufffd[q-B\ufffd\ufffd\ufffd\ufffdR7G\ufffd\ufffd\u02ef\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
F B�E2ʕ|{_��� ܒ�(����/��Q�� ��������~S]җH]�$T &�)%�!i8T� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�E2ʕ|{_��� ܒ�(����/��Q�� ��������~S]җH]�$T &�)%�!i8T� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�E2ʕ|{_��� ܒ�(����/��Q�� ��������~S]җH]�$T &�)%�!i8T� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 331,
"payload_entropy": 6.002033898599495,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "08861f39246f89ed2538ec51accbbc8e",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99fde55a9e1b4a8085013df2182f671fc5b035c5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "FB\ufffdE2\u0295|{_\ufffd\ufffd\ufffd\u0712\ufffd(\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497H]\ufffd$T &\ufffd)%\ufffd!i8T\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdE2\u0295|\b{_\ufffd\ufffd\ufffd\u0013\u001e\u0712\ufffd(\ufffd\ufffd\u0001\ufffd\ufffd\/\u0003\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497\u001bH]\ufffd$\u0001T &\ufffd)%\ufffd!i8T\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffdE2\u0295|{_\ufffd\ufffd\ufffd\u0712\ufffd(\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffdQ\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~S]\u0497H]\ufffd$T &\ufffd)%\ufffd!i8T\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
T P�vY���3� �(U��[ �Y ��S��Nw�6!�X ��q-�8+5c�?��� "Ō���0� -�1 F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P�vY���3� �(U��[
�Y ��S��Nw�6!�X ��q-�8+5c�?���
"Ō���0� -�1 F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P�vY���3� �(U��[ �Y ��S��Nw�6!�X ��q-�8+5c�?��� "Ō���0� -�1 F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 345,
"payload_entropy": 6.089702720923958,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1a7f1d623db34e5be17857599122a682",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8f4234e34eae30dd54897695d2820b2dc8eec5c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "TP\ufffdvY\ufffd\ufffd\ufffd3\ufffd\ufffd(U\ufffd\ufffd[\r\ufffdY\ufffd\ufffdS\ufffd\ufffdNw\ufffd6!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\ufffd\ue384\ufffd\ufffd0\ufffd-\ufffd1F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdvY\ufffd\ufffd\ufffd3\ufffd\f\ufffd(U\ufffd\ufffd[\r\ufffdY\u000b\ufffd\ufffdS\ufffd\ufffdNw\ufffd6\u0007!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\u0017\ufffd\ue384\ufffd\ufffd0\ufffd\u0000-\u0006\ufffd1\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffdvY\ufffd\ufffd\ufffd3\ufffd\ufffd(U\ufffd\ufffd[\r\ufffdY\ufffd\ufffdS\ufffd\ufffdNw\ufffd6!\ufffdX \ufffd\ufffdq-\ufffd8+5c\ufffd?\ufffd\ufffd\ufffd\n\"\u014c\ufffd\ue384\ufffd\ufffd0\ufffd-\ufffd1F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� �#�DU +T)r��bȔK�q����0C��l� 3b(��͊:��� �^���w��� r2EO� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �#�DU +T)r��bȔK�q����0C��l� 3b(��͊:��� �^���w��� r2EO� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �#�DU +T)r��bȔK�q����0C��l� 3b(��͊:��� �^���w��� r2EO� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 424,
"payload_entropy": 5.914858695150057,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7b9bcd2c68adc7bba8037aac95868788",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#\ufffdDU\f+T)r\b\ufffd\ufffdb\u0018\b\u0214\u0007K\ufffdq\ufffd\u0016\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\u001d\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\u001dr2E\u0005O\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#\ufffdDU\f+T)r\b\ufffd\ufffdb\u0018\b\u0214\u0007K\ufffdq\ufffd\u0016\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\u001d\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\u001dr2E\u0005O\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#\ufffdDU\f+T)r\b\ufffd\ufffdb\u0018\b\u0214\u0007K\ufffdq\ufffd\u0016\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\u001d\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\u001dr2E\u0005O\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88710cdd8b14760d339e1bb324ac8a3163e6f3f4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#\ufffdDU\f+T)r\b\ufffd\ufffdb\u0018\b\u0214\u0007K\ufffdq\ufffd\u0016\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\u001d\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\u001dr2E\u0005O\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd#\ufffdDU+T)r\ufffd\ufffdb\u0214K\ufffdq\ufffd\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdr2EO\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#\ufffdDU\f+T)r\b\ufffd\ufffdb\u0018\b\u0214\u0007K\ufffdq\ufffd\u0016\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\u001d\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\u001dr2E\u0005O\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd#\ufffdDU+T)r\ufffd\ufffdb\u0214K\ufffdq\ufffd\ufffd\ufffd\ufffd0C\ufffd\ufffdl\ufffd 3\u209db(\ufffd\ufffd\u034a:\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdr2EO\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� ���#!�'>��,,���] v�V]ʥ�weO�� V-w|����I�`gE��g�� 5�Z��SJ _�N� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���#!�'>��,,���] v�V]ʥ�weO�� V-w|����I�`gE��g�� 5�Z��SJ
_�N� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���#!�'>��,,���] v�V]ʥ�weO�� V-w|����I�`gE��g�� 5�Z��SJ _�N� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 424,
"payload_entropy": 6.001711569056492,
"port_category": "registered",
"org": "M247 Europe SRL",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 9009,
"country": "US",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1d5fd8c09dbc132bc433d46fdc76049034dd872a",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 9009,
"org": "M247 Europe SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a826676d59273b46842f61663573fd5d",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd#!\ufffd'\u0010>\ufffd\ufffd\u0012,,\ufffd\ufffd\ufffd]\fv\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\u0011\ufffd\ufffdg\ufffd\ufffd\u000b5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd#!\ufffd'\u0010>\ufffd\ufffd\u0012,,\ufffd\ufffd\ufffd]\fv\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\u0011\ufffd\ufffdg\ufffd\ufffd\u000b5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd#!\ufffd'\u0010>\ufffd\ufffd\u0012,,\ufffd\ufffd\ufffd]\fv\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\u0011\ufffd\ufffdg\ufffd\ufffd\u000b5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "575e2562614f24a4746f1f70977da2e64f2e1138",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd#!\ufffd'\u0010>\ufffd\ufffd\u0012,,\ufffd\ufffd\ufffd]\fv\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\u0011\ufffd\ufffdg\ufffd\ufffd\u000b5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd#!\ufffd'>\ufffd\ufffd,,\ufffd\ufffd\ufffd]v\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\ufffd\ufffdg\ufffd\ufffd5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd#!\ufffd'\u0010>\ufffd\ufffd\u0012,,\ufffd\ufffd\ufffd]\fv\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\u0011\ufffd\ufffdg\ufffd\ufffd\u000b5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd#!\ufffd'>\ufffd\ufffd,,\ufffd\ufffd\ufffd]v\ufffdV]\u02a5\ufffdw\u009beO\ufffd\ufffd V-w|\ufffd\ufffd\ufffd\ufffdI\ufffd`gE\ufffd\ufffdg\ufffd\ufffd5\ufffdZ\ufffd\ufffdSJ\r_\ufffdN\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Élevée
|
Moyen · 45
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_sni_ip
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
|
|
TCP |
6666
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|