|
|
TCP |
25432
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
25432
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 25432,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4050ab5549935ee157a4746e3b569cb5cb42ecd1",
"event_fingerprint": "f019464edb49c9f10870bdd94247ed3dbda9ffef",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 25432,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae9a4efccaebd3104f68ce88d7ca8c4fd1106332",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "25432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
25432
|
—
|
Sonde port 25432/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
25432
Chemin / cible
—
Preuve honeypot — Sonde port 25432/TCP
Connexion détectée sur le port 25432 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_25432_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
< client_encoding UTF8 user woglet database postgres
Meta JSON brut
{
"bytes_in": 60,
"payload_entropy": 4.096306573128269,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 25432,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 41,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "cca74cbb323167457ad19e668cebe02de35a4859",
"event_fingerprint": "aa276a802dc6919a7800e22637d3a54bd68b0f8c",
"classification_reason": "Type \u00ab port_25432_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88b1d0e5bb7b68a7ac8ee6927a5a9042",
"path_pattern_hash": "2d8809e0bdbbc86a0913912e66921ba6"
},
"target_context": {
"dst_port": 25432,
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000<\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000woglet\u0000database\u0000postgres\u0000\u0000",
"request_sample": "\u0000\u0000\u0000<\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000woglet\u0000database\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000<\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000woglet\u0000database\u0000postgres\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000<\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000woglet\u0000database\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000<\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000woglet\u0000database\u0000postgres\u0000\u0000",
"classification_reason": "Type \u00ab port_25432_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34267701675aa6354f70e6a209f553e4d82cb504",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "25432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
25432
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
25432
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 25432,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4050ab5549935ee157a4746e3b569cb5cb42ecd1",
"event_fingerprint": "f019464edb49c9f10870bdd94247ed3dbda9ffef",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 25432,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c7022cb7f0f996fab478e0c8598ec19bee1b308",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "25432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ec1b881f21ecd0fcceb5b33b30930fc7dd231f2",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ec1b881f21ecd0fcceb5b33b30930fc7dd231f2",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port 5435/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Preuve honeypot — Sonde port 5435/TCP
Connexion détectée sur le port 5435 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5435_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
E client_encoding UTF8 user supabase_admin database _supabase
Meta JSON brut
{
"bytes_in": 69,
"payload_entropy": 4.0664997632230175,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 41,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9907277a6b7a81629be0e7b1aac3a8ae23ff0a28",
"event_fingerprint": "f06b447b9d0292064b69d37dee9d677e27529c8d",
"classification_reason": "Type \u00ab port_5435_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "51ab20cc0a0bb1d416c6fc2f5bf7f8b0",
"path_pattern_hash": "ab13e482c857b5322f630a90c2d5610f"
},
"target_context": {
"dst_port": 5435,
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000E\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000supabase_admin\u0000database\u0000_supabase\u0000\u0000",
"request_sample": "\u0000\u0000\u0000E\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000supabase_admin\u0000database\u0000_supabase\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000E\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000supabase_admin\u0000database\u0000_supabase\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000E\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000supabase_admin\u0000database\u0000_supabase\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000E\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000supabase_admin\u0000database\u0000_supabase\u0000\u0000",
"classification_reason": "Type \u00ab port_5435_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b7dedad76085fcf2bfbfdff764bb7f312f6698e",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35889a390f7d3ce47ad29f65fdc9803b050656aa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35889a390f7d3ce47ad29f65fdc9803b050656aa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ec1b881f21ecd0fcceb5b33b30930fc7dd231f2",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 2,
"behavior_priority": 72
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35889a390f7d3ce47ad29f65fdc9803b050656aa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35889a390f7d3ce47ad29f65fdc9803b050656aa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port 5435/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Preuve honeypot — Sonde port 5435/TCP
Connexion détectée sur le port 5435 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5435_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
, client_encoding UTF8 user postgres
Meta JSON brut
{
"bytes_in": 44,
"payload_entropy": 3.923897009334179,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 41,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9907277a6b7a81629be0e7b1aac3a8ae23ff0a28",
"event_fingerprint": "f06b447b9d0292064b69d37dee9d677e27529c8d",
"classification_reason": "Type \u00ab port_5435_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "16b5610720d04d580da0429df92929da",
"path_pattern_hash": "ab13e482c857b5322f630a90c2d5610f"
},
"target_context": {
"dst_port": 5435,
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"classification_reason": "Type \u00ab port_5435_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37d08fc8dca76e45a609a7fbade828995ff6c342",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5432 · POSTGRES
|
postgres
|
Sonde port 5432/TCP
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_emulated
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5432
Chemin / cible
—
Preuve honeypot — Sonde port 5432/TCP
Connexion détectée sur le port 5432 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5432_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
, client_encoding UTF8 user postgres
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000001252000000057573657200706f73746772657300",
"emulator_response_len": 23,
"bytes_in": 44,
"payload_entropy": 3.923897009334179,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "postgres",
"app_proto": "postgres",
"asn": 209630,
"country": "BG",
"dst_port": 5432,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a57bd49dfb8cb61aea06cfebb213d18f7d12405f",
"event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f",
"classification_reason": "Type \u00ab port_5432_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "postgres",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "16b5610720d04d580da0429df92929da",
"path_pattern_hash": "d943d6c5be0b5f6ac0e178b059fb362e"
},
"target_context": {
"dst_port": 5432,
"service": "postgres",
"service_name": "postgres",
"risk_score": 42
},
"payload_preview": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"classification_reason": "Type \u00ab port_5432_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "745388f035684aee523ac5f49d15d5ad3975929e",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "PostgreSQL 15.4",
"service_os": "linux",
"dst_port": "5432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_emulated",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5432 · POSTGRES
|
postgres
|
Sonde PostgreSQL
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5432
Chemin / cible
—
Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "postgres",
"app_proto": "postgres",
"asn": 209630,
"country": "BG",
"dst_port": 5432,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "272205ffb91c9631a06988b863bb09a8579d4d67",
"event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "postgres",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743"
},
"target_context": {
"dst_port": 5432,
"service": "postgres",
"service_name": "postgres",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c2f90aff0214642f91857fa890d68e267a73363",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "PostgreSQL 15.4",
"service_os": "linux",
"dst_port": "5432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_emulated"
]
}
|
|
|
TCP |
5435
|
—
|
Sonde port 5435/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Preuve honeypot — Sonde port 5435/TCP
Connexion détectée sur le port 5435 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5435_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
, client_encoding UTF8 user postgres
Meta JSON brut
{
"bytes_in": 44,
"payload_entropy": 3.923897009334179,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 41,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9907277a6b7a81629be0e7b1aac3a8ae23ff0a28",
"event_fingerprint": "f06b447b9d0292064b69d37dee9d677e27529c8d",
"classification_reason": "Type \u00ab port_5435_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "16b5610720d04d580da0429df92929da",
"path_pattern_hash": "ab13e482c857b5322f630a90c2d5610f"
},
"target_context": {
"dst_port": 5435,
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"classification_reason": "Type \u00ab port_5435_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37d08fc8dca76e45a609a7fbade828995ff6c342",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35889a390f7d3ce47ad29f65fdc9803b050656aa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ec1b881f21ecd0fcceb5b33b30930fc7dd231f2",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35889a390f7d3ce47ad29f65fdc9803b050656aa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ec1b881f21ecd0fcceb5b33b30930fc7dd231f2",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5435
|
—
|
Sonde port
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5435
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": null,
"app_proto": null,
"asn": 209630,
"country": "BG",
"dst_port": 5435,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "c30294726061697b9b8866aef8f7974c586567bb",
"event_fingerprint": "006460a86f75126b8987840f56ecf90b3a157a44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5435,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ec1b881f21ecd0fcceb5b33b30930fc7dd231f2",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5435"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 2,
"behavior_priority": 72
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
, client_encoding UTF8 user superset
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 44,
"payload_entropy": 3.8873142712787976,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "67eb5fe5a77719b1564f39728acf81aa",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000superset\u0000\u0000",
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000superset\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000superset\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000superset\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000superset\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "416389c917c38fb8a2bbdbdf214bb5fe636e451a",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
, client_encoding UTF8 user keycloak
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 44,
"payload_entropy": 4.014806100243271,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5ecf8712325a59c48bfc3665fd870649",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000keycloak\u0000\u0000",
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000keycloak\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000keycloak\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000keycloak\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000keycloak\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6251964887253bd0ddbc2c37c093f4424d6f394c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
- client_encoding UTF8 user praisonai
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 45,
"payload_entropy": 3.9627723117258147,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1031c41c1ca5365bc313b70ff110f5bf",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000-\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000praisonai\u0000\u0000",
"request_sample": "\u0000\u0000\u0000-\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000praisonai\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000-\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000praisonai\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000-\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000praisonai\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000-\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000praisonai\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1139891cadc957835bbb6d7bcff7b4893e3db03a",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
5 client_encoding UTF8 user openmetadata_user
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 53,
"payload_entropy": 4.08502804298463,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7bda0c61eaffcf6d7143646de4c8f8f4",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u00005\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000openmetadata_user\u0000\u0000",
"request_sample": "\u0000\u0000\u00005\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000openmetadata_user\u0000\u0000",
"payload_snippet": "\u0000\u0000\u00005\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000openmetadata_user\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u00005\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000openmetadata_user\u0000\u0000",
"payload_snippet": "\u0000\u0000\u00005\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000openmetadata_user\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19bb0268e2961caccde3bce5c29ee93a3ae65eb3",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
, client_encoding UTF8 user postgres
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 44,
"payload_entropy": 3.923897009334179,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "16b5610720d04d580da0429df92929da",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000,\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000postgres\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81848bdad4635de52dfef5baca98f5aec4cbbd8f",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
* client_encoding UTF8 user kestra
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 42,
"payload_entropy": 3.9444927726079575,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8355cc2af01a06fb9ab30e98af9299d1",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"request_sample": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5005747f64b5c74d108afd881e1bae6e8205331",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
* client_encoding UTF8 user kestra
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 42,
"payload_entropy": 3.9444927726079575,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8355cc2af01a06fb9ab30e98af9299d1",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"request_sample": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kestra\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5005747f64b5c74d108afd881e1bae6e8205331",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
( client_encoding UTF8 user kong
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 40,
"payload_entropy": 3.851712212208018,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bbe89308acb301dd1f4a5aa647f853e0",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kong\u0000\u0000",
"request_sample": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kong\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kong\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kong\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000kong\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2eb0c2037645ed1750b0cc83602c78bb3283b82d",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
( client_encoding UTF8 user odoo
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 40,
"payload_entropy": 3.782840024653931,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1aa628dfa5f0a4c3acf274b18e1cc1a",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000odoo\u0000\u0000",
"request_sample": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000odoo\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000odoo\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000odoo\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000(\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000odoo\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2873495955901cc888d641727f40f36e2ae72714",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "greenplum",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69e594c3f389cf8cc7811c63ce1c47460e746376",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
greenplum
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Pourquoi cette classification : Type « greenplum » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 8,
"payload_entropy": 2.4056390622295662,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "797503505b65634d5319a0d6b3da2ad9aad7eeb1",
"event_fingerprint": "413203011f6ccb4a8835c9d68320035c9174400b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 5
},
"service_name": "greenplum",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "694bec2754742b999eb8e010ccd19ce8",
"path_pattern_hash": "70af9a1d2d4fb738898a3a9c4fd958ab"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 5
},
"payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"evidence": {
"request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
"classification_reason": "Type \u00ab greenplum \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c496fe733d9741bb48679c6acec37adbb22608c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
* client_encoding UTF8 user strapi
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 42,
"payload_entropy": 3.956164796314459,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f596a36cda183225f36d2e81a7e60c5",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000strapi\u0000\u0000",
"request_sample": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000strapi\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000strapi\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000strapi\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000*\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000strapi\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "041108ef183195516af9da90c4dd7798d3761846",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
5434 · GREENPLUM
|
greenplum
|
Sonde port 5434/TCP
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_postgresql_probe
postgres_startup
postgresql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5434
Chemin / cible
—
Preuve honeypot — Sonde port 5434/TCP
Connexion détectée sur le port 5434 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5434_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
+ client_encoding UTF8 user airflow
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 43,
"payload_entropy": 4.023511026527663,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "greenplum",
"app_proto": "greenplum",
"asn": 209630,
"country": "BG",
"dst_port": 5434,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a463610066cdc94760a9f87c89d37c1b02dc114c",
"event_fingerprint": "097b2ce0289e89a0c42a4ee0e79a9caf7986875b",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "greenplum",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a983eb21810e2a387cf04dbd595600be",
"path_pattern_hash": "899f506885a5875a10dc983d6b8397a0"
},
"target_context": {
"dst_port": 5434,
"service": "greenplum",
"service_name": "greenplum",
"risk_score": 41
},
"payload_preview": "\u0000\u0000\u0000+\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000airflow\u0000\u0000",
"request_sample": "\u0000\u0000\u0000+\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000airflow\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000+\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000airflow\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000+\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000airflow\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000+\u0000\u0003\u0000\u0000client_encoding\u0000UTF8\u0000user\u0000airflow\u0000\u0000",
"classification_reason": "Type \u00ab port_5434_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7efa20d9af11c15e0b271c537a5b33cd6b08d841",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "greenplum",
"service_banner": "honeypot-greenplum",
"service_os": "linux",
"dst_port": "5434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_postgresql_probe",
"postgres_startup",
"postgresql_probe"
]
}
|