|
|
TCP |
14117
|
—
|
Scan de ports
port scan syn · port 14117 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14117
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 14117,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 8,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "b66617b924d4953bebf802e0d5b63d8c52e643e6",
"event_fingerprint": "daaf708ee5a77de36389477ae8ba96c1644daa2c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 14117,
"risk_score": 42
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "367bb27e6f142adab88b5523d90b362d37309250",
"protocol_details": {
"payload_preview": "00000000",
"port": 14117
},
"evidence_snippet": "00000000",
"attack_vector": "port scan syn \u00b7 port 14117 \u00b7 (reconnaissance)",
"target_port_label": "14117",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 8,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 14117,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "00000000",
"port": 14117
},
"attack_vector": "port scan syn \u00b7 port 14117 \u00b7 (reconnaissance)",
"evidence_snippet": "00000000",
"target_port_label": "14117",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "14117"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
14117,
18190,
18476,
18650,
19363
],
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:14117",
"tls"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow"
]
}
|
|
|
TCP |
19363 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19363 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19363
Chemin / cible
—
Service
TLS
Payload
� �t }�R_r��Dz����hX�� ����?��J� ��ټo���Մʯ$�����AHwa�{�[|�`p � &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �t }�R_r��Dz����hX�� ����?��J� ��ټo���Մʯ$�����AHwa�{�[|�`p � &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �t }�R_r��Dz����hX�� ����?��J� ��ټo���Մʯ$�����AHwa�{�[|�`p � &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ H�ab?���e�J��"�2�Is� �"���&
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.886717073734725,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19363,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "704f379e8ec0e95b663da99ba3d28f4b646eaffa",
"event_fingerprint": "6a2ca9b0099fcfe6aadeb6b26157eb7062b13d92",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "709bdc15748199b10dd830d08e9c3064",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19363,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000ft\u001f}\ufffdR_\br\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\u0011\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\u001e\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000ft\u001f}\ufffdR_\br\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\u0011\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\u001e\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 H\ufffdab?\u000e\ufffd\ufffd\ufffde\ufffdJ\ufffd\u001b\ufffd\u0002\"\ufffd2\ufffdIs\ufffd\u001d\ufffd\b\"\ufffd\ufffd\ufffd\u0005&",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000ft\u001f}\ufffdR_\br\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\u0011\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\u001e\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e81dfffa9247bcb918ab434fe89e28a08055e79d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000ft\u001f}\ufffdR_\br\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\u0011\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\u001e\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19363,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdt}\ufffdR_r\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19363 \u00b7 (reconnaissance)",
"target_port_label": "19363 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19363,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000ft\u001f}\ufffdR_\br\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\u0011\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\u001e\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19363,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19363 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdt}\ufffdR_r\ufffd\ufffd\u01f2\ufffd\ufffd\ufffd\ufffdhX\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffdJ\ufffd \ufffd\ufffd\u067co\ufffd\ufffd\ufffd\u0544\u02af$\ufffd\ufffd\ufffd\ufffd\ufffdAHwa\ufffd{\ufffd[|\ufffd`p\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19363 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19363"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 14,
"port_scan_ports_sample": [
18190,
18476,
18590,
18620,
18650,
18797,
18992,
19071,
19169,
19363,
19565,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.81,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18476 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18476 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18476
Chemin / cible
—
Service
TLS
Payload
� �Yvw��D�n1�u[�͵�_���.k �[���CD ��@vjq�T����֥)D��X�r�s*RR֬� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Yvw��D�n1�u[�͵�_���.k �[���CD ��@vjq�T����֥)D��X�r�s*RR֬� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �Yvw��D�n1�u[�͵�_���.k �[���CD ��@vjq�T����֥)D��X�r�s*RR֬� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ "���n�r�gn df�"�P��|��1v�gs��g
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8445819669136245,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18476,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d9ac04c172eb943a0429c37b39d810fd5a5d5cd7",
"event_fingerprint": "cb75bab51b7178c10a9c377142b686e60c8c5ea2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "cb16e501e88f4ea77fdced315d80ec73",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18476,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Yvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\u001e\ufffd[\ufffd\ufffd\ufffd\u0002CD \u0016\ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\u0013\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffd\u0016s*RR\u05ac\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Yvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\u001e\ufffd[\ufffd\ufffd\ufffd\u0002CD \u0016\ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\u0013\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffd\u0016s*RR\u05ac\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \f\"\ufffd\ufffd\ufffdn\ufffdr\ufffdgn\rd\u0011f\ufffd\"\ufffdP\ufffd\ufffd|\ufffd\ufffd1v\ufffdgs\ufffd\ufffdg",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Yvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\u001e\ufffd[\ufffd\ufffd\ufffd\u0002CD \u0016\ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\u0013\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffd\u0016s*RR\u05ac\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b4b8ddbecf927a85be6672538aeb5e41af5f9ad",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Yvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\u001e\ufffd[\ufffd\ufffd\ufffd\u0002CD \u0016\ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\u0013\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffd\u0016s*RR\u05ac\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18476,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdYvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\ufffd[\ufffd\ufffd\ufffdCD \ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffds*RR\u05ac\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18476 \u00b7 (reconnaissance)",
"target_port_label": "18476 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18476,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Yvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\u001e\ufffd[\ufffd\ufffd\ufffd\u0002CD \u0016\ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\u0013\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffd\u0016s*RR\u05ac\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18476,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18476 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdYvw\ufffd\ufffdD\ufffdn1\ufffdu[\ufffd\u0375\ufffd_\ufffd\ufffd\ufffd.k\ufffd[\ufffd\ufffd\ufffdCD \ufffd\ufffd@vjq\ufffdT\ufffd\ufffd\ufffd\ufffd\u05a5)D\ufffd\ufffdX\ufffdr\ufffds*RR\u05ac\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18476 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18476"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
18190,
18476,
18590,
18620,
18650,
18797,
18992,
19071,
19169,
19565,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.08,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18190 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18190 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18190
Chemin / cible
—
Service
TLS
Payload
� �փ��j�Ǔr�yB����(��` ���K}* �d|e��%I �mj��N���#���2F��5c &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �փ��j�Ǔr�yB����(��` ���K}* �d|e��%I
�mj��N���#���2F��5c &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �փ��j�Ǔr�yB����(��` ���K}* �d|e��%I �mj��N���#���2F��5c &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��-j���Op%@zF�go���X�$(ھ�� �`
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.866935620864728,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18190,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7db70531c0c1c61d8bfb9eb04348675f74a867ee",
"event_fingerprint": "eeebddf6cbe6968d9671de8303058cfa58151224",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "c482338996ec9a58315974ef3fcd9d48",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18190,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0583\u0011\ufffd\ufffd\u0001j\ufffd\u0002\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd\u0007(\ufffd\ufffd`\u001f\ufffd\ufffd\ufffdK}* \ufffdd|e\u0014\ufffd\ufffd%I\u0007\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd2F\ufffd\ufffd5c\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0583\u0011\ufffd\ufffd\u0001j\ufffd\u0002\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd\u0007(\ufffd\ufffd`\u001f\ufffd\ufffd\ufffdK}* \ufffdd|e\u0014\ufffd\ufffd%I\u0007\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd2F\ufffd\ufffd5c\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd-\u0007j\ufffd\ufffd\ufffdOp%@zF\ufffdgo\ufffd\ufffd\u0016\ufffdX\ufffd$(\u06be\ufffd\ufffd\u001d\ufffd`",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0583\u0011\ufffd\ufffd\u0001j\ufffd\u0002\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd\u0007(\ufffd\ufffd`\u001f\ufffd\ufffd\ufffdK}* \ufffdd|e\u0014\ufffd\ufffd%I\u0007\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd2F\ufffd\ufffd5c\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87ac8b9afc3f3e3c53521edbcdd7ba48cc1bd620",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0583\u0011\ufffd\ufffd\u0001j\ufffd\u0002\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd\u0007(\ufffd\ufffd`\u001f\ufffd\ufffd\ufffdK}* \ufffdd|e\u0014\ufffd\ufffd%I\u0007\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd2F\ufffd\ufffd5c\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18190,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0583\ufffd\ufffdj\ufffd\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd`\ufffd\ufffd\ufffdK}* \ufffdd|e\ufffd\ufffd%I\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd2F\ufffd\ufffd5c&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18190 \u00b7 (reconnaissance)",
"target_port_label": "18190 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18190,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0583\u0011\ufffd\ufffd\u0001j\ufffd\u0002\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd\u0007(\ufffd\ufffd`\u001f\ufffd\ufffd\ufffdK}* \ufffdd|e\u0014\ufffd\ufffd%I\u0007\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd2F\ufffd\ufffd5c\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18190,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18190 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u0583\ufffd\ufffdj\ufffd\u01d3r\ufffdyB\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd`\ufffd\ufffd\ufffdK}* \ufffdd|e\ufffd\ufffd%I\r\ufffdmj\ufffd\ufffdN\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd2F\ufffd\ufffd5c&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18190 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18190"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
18190,
18590,
18620,
18650,
18797,
18992,
19071,
19169,
19565,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.05,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18650 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18650 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18650
Chemin / cible
—
Service
TLS
Payload
� �ec�G�OY"���cN��bJ�7�Me�Eo5Lת� JM�jƟ\y�*$f��ɦV����t��`$+� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ec�G�OY"���cN��bJ�7�Me�Eo5Lת� JM�jƟ\y�*$f��ɦV����t��`$+� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �ec�G�OY"���cN��bJ�7�Me�Eo5Lת� JM�jƟ\y�*$f��ɦV����t��`$+� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��mB-F �͘�Z�\��Wf�I���}-4�]4
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.85232426377053,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18650,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7cc16b90a51bf60aeff16b9934364f4c4107a997",
"event_fingerprint": "147083748b4b5c18b4d186c31f68d518f6d47e8d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "fab2c2f70a20bf381ef81ba9fb106655",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18650,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003ec\ufffdG\ufffdOY\"\u0017\ufffd\ufffd\ufffdcN\ufffd\ufffdb\bJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffd\u0015j\u019f\\y\ufffd*$f\ufffd\ufffd\u0013\u0266V\ufffd\ufffd\ufffd\ufffd\u0004t\u0004\ufffd\ufffd`$+\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003ec\ufffdG\ufffdOY\"\u0017\ufffd\ufffd\ufffdcN\ufffd\ufffdb\bJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffd\u0015j\u019f\\y\ufffd*$f\ufffd\ufffd\u0013\u0266V\ufffd\ufffd\ufffd\ufffd\u0004t\u0004\ufffd\ufffd`$+\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdmB-F\f\ufffd\u0358\ufffdZ\ufffd\\\u0004\ufffd\ufffdWf\ufffdI\ufffd\u0014\ufffd\ufffd}-4\ufffd\u0010]4",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003ec\ufffdG\ufffdOY\"\u0017\ufffd\ufffd\ufffdcN\ufffd\ufffdb\bJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffd\u0015j\u019f\\y\ufffd*$f\ufffd\ufffd\u0013\u0266V\ufffd\ufffd\ufffd\ufffd\u0004t\u0004\ufffd\ufffd`$+\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9dd03785cda411594428825c02ef9174a75125e1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003ec\ufffdG\ufffdOY\"\u0017\ufffd\ufffd\ufffdcN\ufffd\ufffdb\bJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffd\u0015j\u019f\\y\ufffd*$f\ufffd\ufffd\u0013\u0266V\ufffd\ufffd\ufffd\ufffd\u0004t\u0004\ufffd\ufffd`$+\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18650,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdec\ufffdG\ufffdOY\"\ufffd\ufffd\ufffdcN\ufffd\ufffdbJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffdj\u019f\\y\ufffd*$f\ufffd\ufffd\u0266V\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd`$+\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18650 \u00b7 (reconnaissance)",
"target_port_label": "18650 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18650,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003ec\ufffdG\ufffdOY\"\u0017\ufffd\ufffd\ufffdcN\ufffd\ufffdb\bJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffd\u0015j\u019f\\y\ufffd*$f\ufffd\ufffd\u0013\u0266V\ufffd\ufffd\ufffd\ufffd\u0004t\u0004\ufffd\ufffd`$+\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18650,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18650 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdec\ufffdG\ufffdOY\"\ufffd\ufffd\ufffdcN\ufffd\ufffdbJ\ufffd7\ufffdMe\ufffdEo5L\u05ea\ufffd JM\ufffdj\u019f\\y\ufffd*$f\ufffd\ufffd\u0266V\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd`$+\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18650 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18650"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
18590,
18620,
18650,
18797,
18992,
19071,
19169,
19565,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.9,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18992 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18992 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18992
Chemin / cible
—
Service
TLS
Payload
� �* �,%�8�M���Y7���C����i�f����E3 �:�w���a��e����=��e�1�L�|O &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �* �,%�8�M���Y7���C����i�f����E3 �:�w���a��e����=��e�1�L�|O &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �* �,%�8�M���Y7���C����i�f����E3 �:�w���a��e����=��e�1�L�|O &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ fvml�䍎��I[_ ��];����� �?�#
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.867720100639804,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18992,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "22f082f8fa8aeed6e20de24d85507610dfc314c5",
"event_fingerprint": "f813e26861f8abfd61f2f7acc1b213af00cc8002",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "a586edadd976be59e92c7c81b8b386d8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18992,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*\u001e\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000eC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\u0015\ufffd\ufffd\ufffda\ufffd\u0016\ufffde\ufffd\u0016\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\u0017\ufffd|O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*\u001e\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000eC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\u0015\ufffd\ufffd\ufffda\ufffd\u0016\ufffde\ufffd\u0016\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\u0017\ufffd|O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0017f\u0001vml\ufffd\u434e\ufffd\ufffdI[_\n\ufffd\ufffd];\ufffd\ufffd\ufffd\ufffd\ufffd \n\ufffd?\ufffd#",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*\u001e\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000eC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\u0015\ufffd\ufffd\ufffda\ufffd\u0016\ufffde\ufffd\u0016\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\u0017\ufffd|O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6e6b12db24322e9fdc90b82430f0025ef5374a74",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*\u001e\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000eC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\u0015\ufffd\ufffd\ufffda\ufffd\u0016\ufffde\ufffd\u0016\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\u0017\ufffd|O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18992,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd*\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\ufffd\ufffd\ufffda\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\ufffd|O&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18992 \u00b7 (reconnaissance)",
"target_port_label": "18992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18992,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*\u001e\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000eC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\u0015\ufffd\ufffd\ufffda\ufffd\u0016\ufffde\ufffd\u0016\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\u0017\ufffd|O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18992,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18992 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd*\ufffd,%\ufffd8\ufffdM\ufffd\ufffd\ufffdY7\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdi\ufffdf\ufffd\ufffd\ufffd\ufffdE3 \ufffd:\ufffdw\ufffd\ufffd\ufffda\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffde\ufffd1\ufffdL\ufffd|O&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18992 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18992"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
18590,
18620,
18797,
18992,
19071,
19169,
19565,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.96,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19565 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19565 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19565
Chemin / cible
—
Service
TLS
Payload
� ��&����C����\���(b1��%��@H`��8�{ +vU&�E��+���a�D����E��n-Ib~��^� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��&����C����\���(b1��%��@H`��8�{ +vU&�E��+���a�D����E��n-Ib~��^� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��&����C����\���(b1��%��@H`��8�{ +vU&�E��+���a�D����E��n-Ib~��^� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �}�6�`����p�4V������" x\�Ժ�RU
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.823872273347405,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19565,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d963f8ed68716bc37ce3a0cece50fdc1d2d01da0",
"event_fingerprint": "e79caa2de4d7af8491a37035d9af68d8baee683b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "cbb8742c268984bdc9abc52eae395d88",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19565,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\u0005\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\u0005\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd}\ufffd6\ufffd`\ufffd\ufffd\ufffd\ufffdp\ufffd4V\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\nx\u000e\u0013\\\ufffd\u053a\ufffdRU",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\u0005\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef49cc0181c1c092933a0936e6ff1abcb75bd9de",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\u0005\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19565,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19565 \u00b7 (reconnaissance)",
"target_port_label": "19565 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19565,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\u0005\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19565,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19565 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd(b1\ufffd\ufffd%\ufffd\ufffd@H`\ufffd\ufffd8\ufffd{ +vU&\ufffdE\ufffd\ufffd+\ufffd\ufffd\ufffda\ufffdD\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdn-Ib~\ufffd\ufffd^\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19565 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19565"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
18590,
18620,
18797,
19071,
19169,
19565,
19620,
20131,
28595
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18797 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18797 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18797
Chemin / cible
—
Service
TLS
Payload
� �⺸�ј�R�q/��t� �k��t�Z} �]v �h\M� X^���4 ��hU�|��]��̢( &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �⺸�ј�R�q/��t� �k��t�Z} �]v �h\M� X^���4 ��hU�|��]��̢( &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �⺸�ј�R�q/��t� �k��t�Z} �]v �h\M� X^���4 ��hU�|��]��̢( &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ E���������[���LG6�% �!+}��n� >
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8347187504377045,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18797,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "871d513a57f0d0b87e7aed9965fe6951db897e63",
"event_fingerprint": "4a1a525aaaa7a60fab05f3527c2f4a663619d00b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "34579d76c84b1bf74ba96fa56cbc39ad",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18797,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u2eb8\u0014\ufffd\u0458\u000f\ufffd\u0013R\ufffdq\/\ufffd\ufffdt\ufffd\u001d\u0016\ufffdk\ufffd\ufffdt\ufffdZ}\u0000\ufffd]v \ufffdh\\\u0004M\ufffd\u0018\u001cX^\ufffd\ufffd\ufffd4\f\ufffd\u0013\ufffdhU\ufffd|\ufffd\ufffd]\u0019\ufffd\ufffd\u0322(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u2eb8\u0014\ufffd\u0458\u000f\ufffd\u0013R\ufffdq\/\ufffd\ufffdt\ufffd\u001d\u0016\ufffdk\ufffd\ufffdt\ufffdZ}\u0000\ufffd]v \ufffdh\\\u0004M\ufffd\u0018\u001cX^\ufffd\ufffd\ufffd4\f\ufffd\u0013\ufffdhU\ufffd|\ufffd\ufffd]\u0019\ufffd\ufffd\u0322(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 E\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffdLG6\ufffd%\u001c\ufffd!+}\ufffd\ufffdn\u000f\ufffd\t>",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u2eb8\u0014\ufffd\u0458\u000f\ufffd\u0013R\ufffdq\/\ufffd\ufffdt\ufffd\u001d\u0016\ufffdk\ufffd\ufffdt\ufffdZ}\u0000\ufffd]v \ufffdh\\\u0004M\ufffd\u0018\u001cX^\ufffd\ufffd\ufffd4\f\ufffd\u0013\ufffdhU\ufffd|\ufffd\ufffd]\u0019\ufffd\ufffd\u0322(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6deb3538302b6b6271b2c4b8c4f9c3be15bf9f74",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u2eb8\u0014\ufffd\u0458\u000f\ufffd\u0013R\ufffdq\/\ufffd\ufffdt\ufffd\u001d\u0016\ufffdk\ufffd\ufffdt\ufffdZ}\u0000\ufffd]v \ufffdh\\\u0004M\ufffd\u0018\u001cX^\ufffd\ufffd\ufffd4\f\ufffd\u0013\ufffdhU\ufffd|\ufffd\ufffd]\u0019\ufffd\ufffd\u0322(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18797,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u2eb8\ufffd\u0458\ufffdR\ufffdq\/\ufffd\ufffdt\ufffd\ufffdk\ufffd\ufffdt\ufffdZ}\ufffd]v \ufffdh\\M\ufffdX^\ufffd\ufffd\ufffd4\ufffd\ufffdhU\ufffd|\ufffd\ufffd]\ufffd\ufffd\u0322(&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18797 \u00b7 (reconnaissance)",
"target_port_label": "18797 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18797,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u2eb8\u0014\ufffd\u0458\u000f\ufffd\u0013R\ufffdq\/\ufffd\ufffdt\ufffd\u001d\u0016\ufffdk\ufffd\ufffdt\ufffdZ}\u0000\ufffd]v \ufffdh\\\u0004M\ufffd\u0018\u001cX^\ufffd\ufffd\ufffd4\f\ufffd\u0013\ufffdhU\ufffd|\ufffd\ufffd]\u0019\ufffd\ufffd\u0322(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18797,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18797 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u2eb8\ufffd\u0458\ufffdR\ufffdq\/\ufffd\ufffdt\ufffd\ufffdk\ufffd\ufffdt\ufffdZ}\ufffd]v \ufffdh\\M\ufffdX^\ufffd\ufffd\ufffd4\ufffd\ufffdhU\ufffd|\ufffd\ufffd]\ufffd\ufffd\u0322(&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18797 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18797"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
18590,
18620,
18797,
19071,
19169,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.64,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19620 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19620 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19620
Chemin / cible
—
Service
TLS
Payload
� ��� ,:Y� �Q�D l$�� 0�䯿ie����� P�V19��:�����]R" p�%LN��#[1� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���
,:Y�
�Q�D l$�� 0�䯿ie����� P�V19��:�����]R" p�%LN��#[1� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��� ,:Y� �Q�D l$�� 0�䯿ie����� P�V19��:�����]R" p�%LN��#[1� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ J�s�.%���w����vU:<t8dGs�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.863327467168537,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19620,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3cdc518e0aaf2f672afd15512be602208933281",
"event_fingerprint": "818a32fb6768b96a5dfc502080c083d26ce1702c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "31eb0752204f6bad3bac3f0f3dcb4945",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19620,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdD\fl$\ufffd\ufffd\u001d0\u000e\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\u000f\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\u0014\u000b\u0012\tp\ufffd%LN\ufffd\ufffd#[1\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdD\fl$\ufffd\ufffd\u001d0\u000e\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\u000f\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\u0014\u000b\u0012\tp\ufffd%LN\ufffd\ufffd#[1\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 J\u0010\u0019\ufffd\u001bs\u0004\ufffd.%\ufffd\ufffd\ufffdw\u0019\ufffd\ufffd\ufffd\ufffdvU:<t8dGs\ufffd\u0012",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdD\fl$\ufffd\ufffd\u001d0\u000e\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\u000f\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\u0014\u000b\u0012\tp\ufffd%LN\ufffd\ufffd#[1\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21dee1fa2de7477ae4e2bc6215cf55a3803e12db",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdD\fl$\ufffd\ufffd\u001d0\u000e\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\u000f\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\u0014\u000b\u0012\tp\ufffd%LN\ufffd\ufffd#[1\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19620,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdDl$\ufffd\ufffd0\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\tp\ufffd%LN\ufffd\ufffd#[1\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19620 \u00b7 (reconnaissance)",
"target_port_label": "19620 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19620,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdD\fl$\ufffd\ufffd\u001d0\u000e\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\u000f\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\u0014\u000b\u0012\tp\ufffd%LN\ufffd\ufffd#[1\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19620,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19620 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\n,:Y\ufffd\r\ufffdQ\ufffdDl$\ufffd\ufffd0\ufffd\u4bffie\ufffd\ufffd\ufffd\ufffd\ufffd P\ufffdV19\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd]R\"\tp\ufffd%LN\ufffd\ufffd#[1\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19620 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19620"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
18590,
18620,
19071,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.41,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19169 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19169 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_slow
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19169
Chemin / cible
—
Service
TLS
Payload
� ��2����u�,��HA�E����X�7y�-�� X�:��z_����P�4&��~�VB��#e &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��2����u�,��HA�E����X�7y�-�� X�:��z_����P�4&��~�VB��#e &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��2����u�,��HA�E����X�7y�-�� X�:��z_����P�4&��~�VB��#e &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ @|�����/9��<����ݏ<`�%w��*���u
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.839374412887307,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19169,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8b96ba1fa6846f1d3591bb22abbe4f92643f6723",
"event_fingerprint": "1aff04122664ed64b7e351c79f0cf2e41e31a62f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "0663d9612d1fe528c53ca873443de75a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19169,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\u0007\ufffd\ufffd\u0012\ufffd\u0014u\ufffd,\ufffd\ufffdHA\u0012\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\u000f\ufffd:\u0003\ufffd\ufffdz_\u0014\ufffd\u0003\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\u0002\ufffd\ufffd#e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\u0007\ufffd\ufffd\u0012\ufffd\u0014u\ufffd,\ufffd\ufffdHA\u0012\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\u000f\ufffd:\u0003\ufffd\ufffdz_\u0014\ufffd\u0003\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\u0002\ufffd\ufffd#e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 @|\ufffd\ufffd\ufffd\ufffd\ufffd\/9\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\u074f<`\ufffd%w\ufffd\ufffd*\ufffd\ufffd\u0001\ufffdu",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\u0007\ufffd\ufffd\u0012\ufffd\u0014u\ufffd,\ufffd\ufffdHA\u0012\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\u000f\ufffd:\u0003\ufffd\ufffdz_\u0014\ufffd\u0003\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\u0002\ufffd\ufffd#e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1961d4bd32e02f2f0ffc90d9e295608ae7ca1b16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\u0007\ufffd\ufffd\u0012\ufffd\u0014u\ufffd,\ufffd\ufffdHA\u0012\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\u000f\ufffd:\u0003\ufffd\ufffdz_\u0014\ufffd\u0003\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\u0002\ufffd\ufffd#e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19169,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffdHA\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\ufffd:\ufffd\ufffdz_\ufffd\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\ufffd\ufffd#e&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19169 \u00b7 (reconnaissance)",
"target_port_label": "19169 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19169,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd2\ufffd\u0007\ufffd\ufffd\u0012\ufffd\u0014u\ufffd,\ufffd\ufffdHA\u0012\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\u000f\ufffd:\u0003\ufffd\ufffdz_\u0014\ufffd\u0003\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\u0002\ufffd\ufffd#e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19169,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19169 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffdHA\ufffdE\ufffd\ufffd\ufffd\ufffdX\ufffd7y\ufffd-\ufffd\ufffd X\ufffd:\ufffd\ufffdz_\ufffd\ufffd\ufffd\ufffdP\ufffd4&\ufffd\ufffd~\ufffdVB\ufffd\ufffd#e&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19169 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19169"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
18590,
18620,
19071,
19169,
19620,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.65,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_slow",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18590 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18590 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18590
Chemin / cible
—
Service
TLS
Payload
� ���ciC4z/�4�P�?��S�|K���A�/ <�mW��}f�v���,�� �\����'in� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���ciC4z/�4�P�?��S�|K���A�/ <�mW��}f�v���,��
�\����'in� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���ciC4z/�4�P�?��S�|K���A�/ <�mW��}f�v���,�� �\����'in� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �����@w��l$�]` �D��£?�vk��|
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.795466458955891,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18590,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "98c6c3bd830ce699ecf1b9002889736fe298f8ae",
"event_fingerprint": "99f7580a4b8be88662b7eecad62a72c30a46b7b5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "10bd9082a855fcb28c9e18625462f6ab",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18590,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0013ci\u0002\u0006C\u00044z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\u0010\ufffd\/ <\u0019\ufffdm\u0004W\ufffd\ufffd}\u000ef\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\b\r\ufffd\\\ufffd\b\ufffd\ufffd\ufffd'in\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0013ci\u0002\u0006C\u00044z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\u0010\ufffd\/ <\u0019\ufffdm\u0004W\ufffd\ufffd}\u000ef\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\b\r\ufffd\\\ufffd\b\ufffd\ufffd\ufffd'in\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\b\ufffd\ufffd\ufffd@w\ufffd\ufffd\u0015l$\ufffd]`\u001c\ufffdD\ufffd\ufffd\u00a3?\ufffdv\u001ak\u001b\ufffd\ufffd|",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0013ci\u0002\u0006C\u00044z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\u0010\ufffd\/ <\u0019\ufffdm\u0004W\ufffd\ufffd}\u000ef\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\b\r\ufffd\\\ufffd\b\ufffd\ufffd\ufffd'in\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12aa1ec01ce806f882e2cfcc3e164699bc79ddc5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0013ci\u0002\u0006C\u00044z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\u0010\ufffd\/ <\u0019\ufffdm\u0004W\ufffd\ufffd}\u000ef\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\b\r\ufffd\\\ufffd\b\ufffd\ufffd\ufffd'in\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18590,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdciC4z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\ufffd\/ <\ufffdmW\ufffd\ufffd}f\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\r\ufffd\\\ufffd\ufffd\ufffd\ufffd'in\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18590 \u00b7 (reconnaissance)",
"target_port_label": "18590 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18590,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0013ci\u0002\u0006C\u00044z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\u0010\ufffd\/ <\u0019\ufffdm\u0004W\ufffd\ufffd}\u000ef\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\b\r\ufffd\\\ufffd\b\ufffd\ufffd\ufffd'in\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18590,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18590 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdciC4z\/\ufffd4\ufffdP\ufffd?\ufffd\ufffdS\ufffd|K\ufffd\ufffd\ufffdA\ufffd\/ <\ufffdmW\ufffd\ufffd}f\ufffdv\ufffd\ufffd\ufffd,\ufffd\ufffd\r\ufffd\\\ufffd\ufffd\ufffd\ufffd'in\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18590 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18590"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
18590,
18620,
19071,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 1.41,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
20131 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:20131 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20131
Chemin / cible
—
Service
TLS
Payload
� �o$ 8E�.]�`��}٪m �ʑ��`�ID@ ��*�� bCQ;�ӱn侫 _^u-}�c�ۚ� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �o$ 8E�.]�`��}٪m �ʑ��`�ID@ ��*�� bCQ;�ӱn侫 _^u-}�c�ۚ� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �o$ 8E�.]�`��}٪m �ʑ��`�ID@ ��*�� bCQ;�ӱn侫 _^u-}�c�ۚ� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��J�>JH�o%��B�\��q4>���gM|W
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8607622835579765,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 20131,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9a9c4583195c807fbff122939628cc281793ee55",
"event_fingerprint": "ef77c8f3621f005dc2147f7d2c49192292e10d9a",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "f1dfe5ab4d475d79e811e5f3866028ff",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 20131,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001o$\t8\u0014E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\u0015\ufffd\u0019ID\u0018@ \ufffd\u0015\ufffd*\ufffd\u0007\ufffd\u001dbCQ;\ufffd\u04f1\u001bn\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001o$\t8\u0014E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\u0015\ufffd\u0019ID\u0018@ \ufffd\u0015\ufffd*\ufffd\u0007\ufffd\u001dbCQ;\ufffd\u04f1\u001bn\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdJ\ufffd>J\u0006H\ufffdo%\ufffd\ufffd\u001bB\ufffd\\\u000e\ufffd\ufffdq4\u0001>\ufffd\ufffd\ufffdgM|W",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001o$\t8\u0014E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\u0015\ufffd\u0019ID\u0018@ \ufffd\u0015\ufffd*\ufffd\u0007\ufffd\u001dbCQ;\ufffd\u04f1\u001bn\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "066df69e78f5b4ac6fb59166907f4895eed56f1d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001o$\t8\u0014E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\u0015\ufffd\u0019ID\u0018@ \ufffd\u0015\ufffd*\ufffd\u0007\ufffd\u001dbCQ;\ufffd\u04f1\u001bn\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 20131,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdo$\t8E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\ufffdID@ \ufffd\ufffd*\ufffd\ufffdbCQ;\ufffd\u04f1n\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:20131 \u00b7 (sonde \/ probe)",
"target_port_label": "20131 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 20131,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001o$\t8\u0014E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\u0015\ufffd\u0019ID\u0018@ \ufffd\u0015\ufffd*\ufffd\u0007\ufffd\u001dbCQ;\ufffd\u04f1\u001bn\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 20131,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:20131 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdo$\t8E\ufffd.]\ufffd`\ufffd\ufffd}\u066am\t\ufffd\u0291\ufffd\ufffd`\ufffdID@ \ufffd\ufffd*\ufffd\ufffdbCQ;\ufffd\u04f1n\u4fab\t_^u-}\ufffdc\ufffd\u06da\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "20131 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "20131"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19071 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19071 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19071
Chemin / cible
—
Service
TLS
Payload
� �>r7�I��<Xc�6Z�r��7�]�H�"�yj ��bש� ���"�&�ߩ<5/��y杣�ܥ� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �>r7�I��<Xc�6Z�r��7�]�H�"�yj ��bש�
���"�&�ߩ<5/��y杣�ܥ� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �>r7�I��<Xc�6Z�r��7�]�H�"�yj ��bש� ���"�&�ߩ<5/��y杣�ܥ� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ 0-�5P剤\�zl� �����>�>u����m
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.775512808637473,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19071,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "19c7866d93bc86cc0cec37c130724e791070c161",
"event_fingerprint": "19ef0f94b6741e1f1f3ca20f8cab7821bbb9fd30",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "2f772d658c89476010817d11a11970ac",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19071,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>r7\ufffdI\u000f\ufffd\ufffd\u0015<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\u000e\ufffd]\ufffdH\ufffd\"\ufffdyj\u0003 \ufffd\ufffd\u0007b\u05e9\ufffd\n\ufffd\ufffd\b\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u0018\u6763\ufffd\u0725\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>r7\ufffdI\u000f\ufffd\ufffd\u0015<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\u000e\ufffd]\ufffdH\ufffd\"\ufffdyj\u0003 \ufffd\ufffd\u0007b\u05e9\ufffd\n\ufffd\ufffd\b\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u0018\u6763\ufffd\u0725\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 0-\ufffd\u00055P\u5264\\\ufffdzl\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd>u\ufffd\ufffd\ufffd\ufffdm\u000f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>r7\ufffdI\u000f\ufffd\ufffd\u0015<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\u000e\ufffd]\ufffdH\ufffd\"\ufffdyj\u0003 \ufffd\ufffd\u0007b\u05e9\ufffd\n\ufffd\ufffd\b\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u0018\u6763\ufffd\u0725\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff7c165d95e31dec5f377db54ae639e23d2164d7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>r7\ufffdI\u000f\ufffd\ufffd\u0015<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\u000e\ufffd]\ufffdH\ufffd\"\ufffdyj\u0003 \ufffd\ufffd\u0007b\u05e9\ufffd\n\ufffd\ufffd\b\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u0018\u6763\ufffd\u0725\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19071,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd>r7\ufffdI\ufffd\ufffd<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\ufffd]\ufffdH\ufffd\"\ufffdyj \ufffd\ufffdb\u05e9\ufffd\n\ufffd\ufffd\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u6763\ufffd\u0725\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19071 \u00b7 (reconnaissance)",
"target_port_label": "19071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>r7\ufffdI\u000f\ufffd\ufffd\u0015<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\u000e\ufffd]\ufffdH\ufffd\"\ufffdyj\u0003 \ufffd\ufffd\u0007b\u05e9\ufffd\n\ufffd\ufffd\b\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u0018\u6763\ufffd\u0725\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19071,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19071 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd>r7\ufffdI\ufffd\ufffd<Xc\ufffd6Z\ufffdr\ufffd\ufffd7\ufffd]\ufffdH\ufffd\"\ufffdyj \ufffd\ufffdb\u05e9\ufffd\n\ufffd\ufffd\ufffd\"\ufffd&\ufffd\u07e9<5\/\ufffd\ufffdy\u6763\ufffd\u0725\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18620 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18620 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18620
Chemin / cible
—
Service
TLS
Payload
� ����Ӽ{s�:����� ��D�җ�]�4g0 �yEZa���� =W��5��ݕ��)� 7�0� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����Ӽ{s�:����� ��D�җ�]�4g0 �yEZa���� =W��5��ݕ��)�
7�0� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ����Ӽ{s�:����� ��D�җ�]�4g0 �yEZa���� =W��5��ݕ��)� 7�0� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ h9��� U�t�>���m� �-ꍨѩfݗrv
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.802793427909452,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18620,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9f349c077be3ad9c4cf8c0ce93ec42662d4d2213",
"event_fingerprint": "9633e99ac98a0efbfffc52eb742580f8c9bf9d10",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "cba0ccc16bb9448760c42bfea78dc99e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18620,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\u04fc{\u0006s\ufffd\u000e:\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffdD\u001b\ufffd\u0497\u0002\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\u0016\ufffd\ufffd\u0005\ufffd\u000b=W\ufffd\ufffd5\ufffd\ufffd\u0755\u0003\ufffd\ufffd)\ufffd\u001e\r7\ufffd0\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\u04fc{\u0006s\ufffd\u000e:\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffdD\u001b\ufffd\u0497\u0002\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\u0016\ufffd\ufffd\u0005\ufffd\u000b=W\ufffd\ufffd5\ufffd\ufffd\u0755\u0003\ufffd\ufffd)\ufffd\u001e\r7\ufffd0\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 h9\ufffd\ufffd\ufffd\fU\ufffdt\ufffd>\ufffd\ufffd\ufffdm\ufffd\u001d\u001e\ufffd-\ua368\u0006\u0469f\u0757rv",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\u04fc{\u0006s\ufffd\u000e:\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffdD\u001b\ufffd\u0497\u0002\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\u0016\ufffd\ufffd\u0005\ufffd\u000b=W\ufffd\ufffd5\ufffd\ufffd\u0755\u0003\ufffd\ufffd)\ufffd\u001e\r7\ufffd0\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9326fac0e752d4940ffb60e10d010ead0a652212",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\u04fc{\u0006s\ufffd\u000e:\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffdD\u001b\ufffd\u0497\u0002\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\u0016\ufffd\ufffd\u0005\ufffd\u000b=W\ufffd\ufffd5\ufffd\ufffd\u0755\u0003\ufffd\ufffd)\ufffd\u001e\r7\ufffd0\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18620,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u04fc{s\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\u0497\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\ufffd\ufffd\ufffd=W\ufffd\ufffd5\ufffd\ufffd\u0755\ufffd\ufffd)\ufffd\r7\ufffd0\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18620 \u00b7 (reconnaissance)",
"target_port_label": "18620 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18620,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0005\u04fc{\u0006s\ufffd\u000e:\ufffd\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffdD\u001b\ufffd\u0497\u0002\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\u0016\ufffd\ufffd\u0005\ufffd\u000b=W\ufffd\ufffd5\ufffd\ufffd\u0755\u0003\ufffd\ufffd)\ufffd\u001e\r7\ufffd0\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18620,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18620 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u04fc{s\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\u0497\ufffd]\ufffd4g0 \ufffdyEZa\ufffd\ufffd\ufffd\ufffd=W\ufffd\ufffd5\ufffd\ufffd\u0755\ufffd\ufffd)\ufffd\r7\ufffd0\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18620 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18620"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
18620,
19071,
20131,
28595
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 3.17,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
28595 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:28595 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28595
Chemin / cible
—
Service
TLS
Payload
� ������U���BQN�w*1�� �̠�� x�� �ڰEv~�7c�'l��\�ѷL�ŏ���mPX#w &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������U���BQN�w*1�� �̠��
x�� �ڰEv~�7c�'l��\�ѷL�ŏ���mPX#w &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ������U���BQN�w*1�� �̠�� x�� �ڰEv~�7c�'l��\�ѷL�ŏ���mPX#w &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ @�0߾()�5G�XU�Oa���s����!M8
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.904159413282906,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 28595,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3fd4b023e2fbb5f3eaf939fd2537e3d4635eef91",
"event_fingerprint": "34b775081909d88dcb1940b2dd4b0412c5543481",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "413d97cf02e0786b972f817cf986249e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 28595,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\u0010\ufffd\u0018\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\u0019\ufffd\ufffdmPX#w\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\u0010\ufffd\u0018\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\u0019\ufffd\ufffdmPX#w\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 @\ufffd0\u07fe()\ufffd5G\ufffdXU\ufffd\u0015O\u0018a\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\u0003\ufffd!\u0015M\u00148",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\u0010\ufffd\u0018\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\u0019\ufffd\ufffdmPX#w\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb93cde01351dcac2ea828cd03177e9b4740dfae",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\u0010\ufffd\u0018\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\u0019\ufffd\ufffdmPX#w\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28595,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\ufffd\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\ufffd\ufffdmPX#w&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:28595 \u00b7 (sonde \/ probe)",
"target_port_label": "28595 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 28595,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\u0010\ufffd\u0018\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\u0019\ufffd\ufffdmPX#w\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28595,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:28595 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdBQN\ufffdw*1\ufffd\ufffd \ufffd\u0320\ufffd\ufffd\nx\ufffd\ufffd \ufffd\u06b0Ev~\ufffd7c\ufffd'l\ufffd\ufffd\\\ufffd\u0477L\ufffd\u014f\ufffd\ufffd\ufffdmPX#w&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "28595 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "28595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 19,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
28759 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:28759 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28759
Chemin / cible
—
Service
TLS
Payload
� �dtX_�yG����g�(o�4�?iy I�� ?��� �U_�o ��NJB59 >��F:�: h���C � &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �dtX_�yG����g�(o�4�?iy I��
?��� �U_�o ��NJB59
>��F:�: h���C � &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �dtX_�yG����g�(o�4�?iy I�� ?��� �U_�o ��NJB59 >��F:�: h���C � &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �ѭ1����牺�:����f)U�uÂ�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.843699749926291,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 28759,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "decc892bce746bf23215cb75288c61aa83903d88",
"event_fingerprint": "ed30d581dbe495f2ce4d24327be4bbaf1c999117",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "d22392650268d039636355b0bb9c7924",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 28759,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003dt\u0006X_\ufffdyG\ufffd\ufffd\ufffd\u001b\ufffdg\ufffd(o\ufffd4\ufffd?iy\u001cI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\u001c\u0010\ufffd\ufffdNJB59\u0012\r>\ufffd\ufffdF:\ufffd:\fh\ufffd\ufffd\ufffdC \ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003dt\u0006X_\ufffdyG\ufffd\ufffd\ufffd\u001b\ufffdg\ufffd(o\ufffd4\ufffd?iy\u001cI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\u001c\u0010\ufffd\ufffdNJB59\u0012\r>\ufffd\ufffdF:\ufffd:\fh\ufffd\ufffd\ufffdC \ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001a\u046d1\ufffd\ufffd\ufffd\ufffd\u727a\u0004\ufffd:\ufffd\ufffd\ufffd\ufffd\u0011f)U\u07ba\ufffdu\u00c2\ufffd\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003dt\u0006X_\ufffdyG\ufffd\ufffd\ufffd\u001b\ufffdg\ufffd(o\ufffd4\ufffd?iy\u001cI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\u001c\u0010\ufffd\ufffdNJB59\u0012\r>\ufffd\ufffdF:\ufffd:\fh\ufffd\ufffd\ufffdC \ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e288a14f628ec997aacca34a716b3e633a9d1973",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003dt\u0006X_\ufffdyG\ufffd\ufffd\ufffd\u001b\ufffdg\ufffd(o\ufffd4\ufffd?iy\u001cI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\u001c\u0010\ufffd\ufffdNJB59\u0012\r>\ufffd\ufffdF:\ufffd:\fh\ufffd\ufffd\ufffdC \ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28759,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffddtX_\ufffdyG\ufffd\ufffd\ufffd\ufffdg\ufffd(o\ufffd4\ufffd?iyI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\ufffd\ufffdNJB59\r>\ufffd\ufffdF:\ufffd:h\ufffd\ufffd\ufffdC \ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:28759 \u00b7 (reconnaissance)",
"target_port_label": "28759 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 28759,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003dt\u0006X_\ufffdyG\ufffd\ufffd\ufffd\u001b\ufffdg\ufffd(o\ufffd4\ufffd?iy\u001cI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\u001c\u0010\ufffd\ufffdNJB59\u0012\r>\ufffd\ufffdF:\ufffd:\fh\ufffd\ufffd\ufffdC \ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28759,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:28759 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffddtX_\ufffdyG\ufffd\ufffd\ufffd\ufffdg\ufffd(o\ufffd4\ufffd?iyI\ufffd\ufffd\n?\ufffd\ufffd\ufffd \ufffdU_\ufffdo\ufffd\ufffdNJB59\r>\ufffd\ufffdF:\ufffd:h\ufffd\ufffd\ufffdC \ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "28759 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "28759"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663,
27760,
28046,
28101,
28363,
28418,
28759
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
28363 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:28363 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28363
Chemin / cible
—
Service
TLS
Payload
� ������7�Y`�;�'>�L���� �r{ �S �p�a��vkܧ ��Q���BV+9Lڭ�&�Z`� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������7�Y`�;�'>�L���� �r{ �S �p�a��vkܧ
��Q���BV+9Lڭ�&�Z`� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ������7�Y`�;�'>�L���� �r{ �S �p�a��vkܧ ��Q���BV+9Lڭ�&�Z`� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ���������3T �Z���l�=?�W���1
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.854365728220725,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 28363,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a1b141d5f4cf69ff1c87bd9ce5c068cf8dac0870",
"event_fingerprint": "62213cc797c8db024def57d028ea17c83f979e3b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "7d98ed9e972b2d6ad736ad4b960f1c8a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 28363,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0016\u0007\ufffd\ufffd\ufffd\u00177\ufffd\u0003\u0010Y`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\u000b\ufffdr{\u001e\ufffdS \ufffdp\ufffd\u0017a\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffd\u0015BV+9L\u06ad\ufffd&\ufffdZ`\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0016\u0007\ufffd\ufffd\ufffd\u00177\ufffd\u0003\u0010Y`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\u000b\ufffdr{\u001e\ufffdS \ufffdp\ufffd\u0017a\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffd\u0015BV+9L\u06ad\ufffd&\ufffdZ`\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0011\u0007\ufffd\ufffd\ufffd\ufffd3T\f\ufffdZ\ufffd\ufffd\ufffdl\ufffd=?\ufffd\u000fW\ufffd\ufffd\ufffd1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0016\u0007\ufffd\ufffd\ufffd\u00177\ufffd\u0003\u0010Y`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\u000b\ufffdr{\u001e\ufffdS \ufffdp\ufffd\u0017a\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffd\u0015BV+9L\u06ad\ufffd&\ufffdZ`\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e50d709416bcb5cf2169f9fb126ec44a457eaed5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0016\u0007\ufffd\ufffd\ufffd\u00177\ufffd\u0003\u0010Y`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\u000b\ufffdr{\u001e\ufffdS \ufffdp\ufffd\u0017a\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffd\u0015BV+9L\u06ad\ufffd&\ufffdZ`\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28363,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffdY`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdr{\ufffdS \ufffdp\ufffda\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffdBV+9L\u06ad\ufffd&\ufffdZ`\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:28363 \u00b7 (reconnaissance)",
"target_port_label": "28363 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 28363,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0016\u0007\ufffd\ufffd\ufffd\u00177\ufffd\u0003\u0010Y`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\u000b\ufffdr{\u001e\ufffdS \ufffdp\ufffd\u0017a\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffd\u0015BV+9L\u06ad\ufffd&\ufffdZ`\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28363,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:28363 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffdY`\ufffd;\ufffd'>\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdr{\ufffdS \ufffdp\ufffda\ufffd\ufffdvk\u0727\r\ufffd\ufffdQ\ufffd\ufffd\ufffdBV+9L\u06ad\ufffd&\ufffdZ`\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "28363 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "28363"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663,
27760,
28046,
28101,
28363,
28418
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 2.08,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
27760 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:27760 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27760
Chemin / cible
—
Service
TLS
Payload
� ���˱�Ä�"�Di�6��E���~PT RK\ .���ν^�u�,��W`Oy��7���d� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���˱�Ä�"�Di�6��E���~PT
RK\ .���ν^�u�,��W`Oy��7���d� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���˱�Ä�"�Di�6��E���~PT RK\ .���ν^�u�,��W`Oy��7���d� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��k� �#u������ю�.&���$#��
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.744285894571153,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 27760,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "034a60d128403a36d8a77fcf4625a1fe6961a3cc",
"event_fingerprint": "9f8168808d04ed91f4d5fa92462fc4f902cfab80",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "31c2503e4cf5fde726ad3535800c51d9",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 27760,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\ufffd\ufffd\u0019\u02f1\ufffd\u00c4\ufffd\"\u0004\ufffdDi\ufffd6\u0001\ufffd\ufffdE\ufffd\ufffd\u0007\ufffd~PT\nRK\\ \u0014.\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`\u0014Oy\ufffd\u0017\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\ufffd\ufffd\u0019\u02f1\ufffd\u00c4\ufffd\"\u0004\ufffdDi\ufffd6\u0001\ufffd\ufffdE\ufffd\ufffd\u0007\ufffd~PT\nRK\\ \u0014.\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`\u0014Oy\ufffd\u0017\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010\u0018\ufffd\ufffdk\ufffd\n\ufffd#u\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\u044e\ufffd.&\ufffd\ufffd\ufffd$\u0007#\ufffd\ufffd\u0002",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\ufffd\ufffd\u0019\u02f1\ufffd\u00c4\ufffd\"\u0004\ufffdDi\ufffd6\u0001\ufffd\ufffdE\ufffd\ufffd\u0007\ufffd~PT\nRK\\ \u0014.\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`\u0014Oy\ufffd\u0017\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f74ccfbc1417e2ccc4e77a299bc08da596e359da",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\ufffd\ufffd\u0019\u02f1\ufffd\u00c4\ufffd\"\u0004\ufffdDi\ufffd6\u0001\ufffd\ufffdE\ufffd\ufffd\u0007\ufffd~PT\nRK\\ \u0014.\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`\u0014Oy\ufffd\u0017\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 27760,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u02f1\ufffd\u00c4\ufffd\"\ufffdDi\ufffd6\ufffd\ufffdE\ufffd\ufffd\ufffd~PT\nRK\\ .\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`Oy\ufffd\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:27760 \u00b7 (reconnaissance)",
"target_port_label": "27760 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 27760,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\ufffd\ufffd\u0019\u02f1\ufffd\u00c4\ufffd\"\u0004\ufffdDi\ufffd6\u0001\ufffd\ufffdE\ufffd\ufffd\u0007\ufffd~PT\nRK\\ \u0014.\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`\u0014Oy\ufffd\u0017\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 27760,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:27760 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u02f1\ufffd\u00c4\ufffd\"\ufffdDi\ufffd6\ufffd\ufffdE\ufffd\ufffd\ufffd~PT\nRK\\ .\ufffd\ufffd\ufffd\u03bd^\ufffdu\ufffd,\ufffd\ufffdW`Oy\ufffd\ufffd7\ufffd\u008e\ufffd\ufffdd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "27760 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "27760"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663,
27760,
28046,
28101
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
28418 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:28418 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28418
Chemin / cible
—
Service
TLS
Payload
� �g� �$���0 檓�*2�n 7:�l�S� 1��M����� E��,�� ��0/.6�ՄO &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �g� �$���0 檓�*2�n 7:�l�S� 1��M����� E��,�� ��0/.6�ՄO &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �g� �$���0 檓�*2�n 7:�l�S� 1��M����� E��,�� ��0/.6�ՄO &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �V���0W� �ts�\���5��'���o9�}[
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.822199960768939,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 28418,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "832002ce0de15f12387eca9bbab328a9172d2fe4",
"event_fingerprint": "1985be887744244f6d533f75cb117061090e03d7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "11e35a8b9393ff70d4509e45e1f03312",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 28418,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g\ufffd\u001c\ufffd$\ufffd\ufffd\u0007\ufffd0\t\u6a93\u0005\ufffd*2\b\ufffdn\u0003\u001f7\u0006:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u001dE\ufffd\ufffd\u0019,\ufffd\ufffd\f\ufffd\ufffd0\/.6\ufffd\u0544O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g\ufffd\u001c\ufffd$\ufffd\ufffd\u0007\ufffd0\t\u6a93\u0005\ufffd*2\b\ufffdn\u0003\u001f7\u0006:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u001dE\ufffd\ufffd\u0019,\ufffd\ufffd\f\ufffd\ufffd0\/.6\ufffd\u0544O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdV\ufffd\ufffd\ufffd\u001b0W\ufffd\r\u0004\ufffdts\ufffd\\\ufffd\ufffd\ufffd5\ufffd\ufffd'\ufffd\ufffd\u0013\ufffdo9\ufffd}[",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g\ufffd\u001c\ufffd$\ufffd\ufffd\u0007\ufffd0\t\u6a93\u0005\ufffd*2\b\ufffdn\u0003\u001f7\u0006:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u001dE\ufffd\ufffd\u0019,\ufffd\ufffd\f\ufffd\ufffd0\/.6\ufffd\u0544O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cccc9d2e4403714779a5323419c99991b37df4e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g\ufffd\u001c\ufffd$\ufffd\ufffd\u0007\ufffd0\t\u6a93\u0005\ufffd*2\b\ufffdn\u0003\u001f7\u0006:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u001dE\ufffd\ufffd\u0019,\ufffd\ufffd\f\ufffd\ufffd0\/.6\ufffd\u0544O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28418,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdg\ufffd\ufffd$\ufffd\ufffd\ufffd0\t\u6a93\ufffd*2\ufffdn7:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd0\/.6\ufffd\u0544O&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:28418 \u00b7 (reconnaissance)",
"target_port_label": "28418 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 28418,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g\ufffd\u001c\ufffd$\ufffd\ufffd\u0007\ufffd0\t\u6a93\u0005\ufffd*2\b\ufffdn\u0003\u001f7\u0006:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u001dE\ufffd\ufffd\u0019,\ufffd\ufffd\f\ufffd\ufffd0\/.6\ufffd\u0544O\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28418,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:28418 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdg\ufffd\ufffd$\ufffd\ufffd\ufffd0\t\u6a93\ufffd*2\ufffdn7:\ufffdl\ufffdS\ufffd 1\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd0\/.6\ufffd\u0544O&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "28418 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "28418"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663,
27760,
28046,
28101,
28418
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.65,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
28046 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:28046 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28046
Chemin / cible
—
Service
TLS
Payload
� ��j�df�/��e���2��.��s;7] X��I ��@8-K������=ls� .�̡��4�r� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��j�df�/��e���2��.��s;7] X��I ��@8-K������=ls� .�̡��4�r� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��j�df�/��e���2��.��s;7] X��I ��@8-K������=ls� .�̡��4�r� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ _�-a0F�clUc��M�߶w}$v@��'��?��N
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.830774628563447,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 28046,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "49ec5d78ffb8c62210c208a3c55feeab8859e511",
"event_fingerprint": "35f5ab7f4bdb14bfd842d1962bdd4a19e6c7ffcb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "dd1dd81f1b2227a76247ad0288a17724",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 28046,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\u0007\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\t\fX\ufffd\ufffd\u0005I \u0016\ufffd\u0006\ufffd@8-\u0010K\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd=ls\ufffd\u0000.\ufffd\u0321\ufffd\ufffd\u00034\ufffdr\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\u0007\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\t\fX\ufffd\ufffd\u0005I \u0016\ufffd\u0006\ufffd@8-\u0010K\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd=ls\ufffd\u0000.\ufffd\u0321\ufffd\ufffd\u00034\ufffdr\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 _\ufffd-a0F\ufffdclUc\ufffd\ufffdM\ufffd\u07f6w}$v@\ufffd\ufffd'\ufffd\ufffd?\ufffd\ufffd\u0016N",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\u0007\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\t\fX\ufffd\ufffd\u0005I \u0016\ufffd\u0006\ufffd@8-\u0010K\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd=ls\ufffd\u0000.\ufffd\u0321\ufffd\ufffd\u00034\ufffdr\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38c6bde99d503eeb0137a26e2fea8a783435bd9a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\u0007\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\t\fX\ufffd\ufffd\u0005I \u0016\ufffd\u0006\ufffd@8-\u0010K\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd=ls\ufffd\u0000.\ufffd\u0321\ufffd\ufffd\u00034\ufffdr\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28046,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\tX\ufffd\ufffdI \ufffd\ufffd@8-K\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=ls\ufffd.\ufffd\u0321\ufffd\ufffd4\ufffdr\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:28046 \u00b7 (reconnaissance)",
"target_port_label": "28046 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 28046,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\u0007\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\t\fX\ufffd\ufffd\u0005I \u0016\ufffd\u0006\ufffd@8-\u0010K\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\ufffd=ls\ufffd\u0000.\ufffd\u0321\ufffd\ufffd\u00034\ufffdr\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28046,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:28046 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffddf\ufffd\/\ufffd\ufffde\ufffd\ufffd\ufffd2\ufffd\ufffd.\ufffd\ufffds;7]\tX\ufffd\ufffdI \ufffd\ufffd@8-K\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=ls\ufffd.\ufffd\u0321\ufffd\ufffd4\ufffdr\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "28046 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "28046"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663,
28046,
28101
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
28101 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:28101 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
28101
Chemin / cible
—
Service
TLS
Payload
� ��/F�}c�Y�/&�����f4�>w��4�� Ӫ� nI�`�)��A6{��ӈ�nc�Q8��@��Gb &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��/F�}c�Y�/&�����f4�>w��4�� Ӫ� nI�`�)��A6{��ӈ�nc�Q8��@��Gb &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��/F�}c�Y�/&�����f4�>w��4�� Ӫ� nI�`�)��A6{��ӈ�nc�Q8��@��Gb &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ � D��������'�P -ޤ> �ג�[�~
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.878592923730458,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 28101,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "303ef6ae3a6e3ebe8ba567ad58dc6301bfd28ce3",
"event_fingerprint": "8465a7440b9487d4b5132dd11f640ef7b27ad311",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "e4a2c675f70c2cae6c1ee734953ad771",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 28101,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\u0007\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffd\u0017A6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd\u0002@\ufffd\ufffdGb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\u0007\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffd\u0017A6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd\u0002@\ufffd\ufffdGb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u000e\nD\ufffd\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffdP\f\u000b-\u07a4\u001a> \ufffd\u05d2\ufffd[\u0012\ufffd~",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\u0007\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffd\u0017A6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd\u0002@\ufffd\ufffdGb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "06bcf6b7242cca5f4c55b04406308f297b6e088d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\u0007\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffd\u0017A6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd\u0002@\ufffd\ufffdGb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28101,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffdA6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd@\ufffd\ufffdGb&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:28101 \u00b7 (reconnaissance)",
"target_port_label": "28101 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 28101,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\u0007\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffd\u0017A6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd\u0002@\ufffd\ufffdGb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 28101,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:28101 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\/F\ufffd}c\ufffdY\ufffd\/&\ufffd\ufffd\ufffd\ufffd\ufffdf4\ufffd>w\ufffd\ufffd4\ufffd\ufffd\t\u04ea\ufffd nI\ufffd`\ufffd)\ufffd\ufffdA6{\ufffd\ufffd\u04c8\ufffdnc\ufffdQ8\ufffd\ufffd@\ufffd\ufffdGb&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "28101 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "28101"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663,
28101
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
24229 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:24229 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
24229
Chemin / cible
—
Service
TLS
Payload
� ��Gm���������G]8�R��r�9�N �Ú�fy�<�!��G�s��45U间M�- &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Gm���������G]8�R��r�9�N �Ú�fy�<�!��G�s��45U间M�- &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��Gm���������G]8�R��r�9�N �Ú�fy�<�!��G�s��45U间M�- &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��o->^{x����p�Y�ր5i=���e� �l
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.828823995643165,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 24229,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "62f9a9e2dd001d241978124023ee29edeb580fc5",
"event_fingerprint": "7342273a0f643d7e08eab96d67f83ce644eb2fbc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "0062617d6cae71aa19839c86a12cff2e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 24229,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGm\ufffd\u0016\ufffd\ufffd\u0003\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0005\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffd\u0015\u0015N \ufffd\u00da\ufffdfy\ufffd<\ufffd\u001a!\u0013\u0016\ufffd\ufffd\u001bG\ufffds\ufffd\u0010\ufffd45U\u95f4M\ufffd-\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGm\ufffd\u0016\ufffd\ufffd\u0003\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0005\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffd\u0015\u0015N \ufffd\u00da\ufffdfy\ufffd<\ufffd\u001a!\u0013\u0016\ufffd\ufffd\u001bG\ufffds\ufffd\u0010\ufffd45U\u95f4M\ufffd-\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0016\ufffdo->^{x\u0019\ufffd\ufffd\ufffd\ufffdp\ufffdY\ufffd\u05805i=\ufffd\ufffd\ufffde\ufffd \ufffdl",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGm\ufffd\u0016\ufffd\ufffd\u0003\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0005\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffd\u0015\u0015N \ufffd\u00da\ufffdfy\ufffd<\ufffd\u001a!\u0013\u0016\ufffd\ufffd\u001bG\ufffds\ufffd\u0010\ufffd45U\u95f4M\ufffd-\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38e0ecf18e8f7469b3a160bd7395e72ee5cf2ec8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGm\ufffd\u0016\ufffd\ufffd\u0003\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0005\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffd\u0015\u0015N \ufffd\u00da\ufffdfy\ufffd<\ufffd\u001a!\u0013\u0016\ufffd\ufffd\u001bG\ufffds\ufffd\u0010\ufffd45U\u95f4M\ufffd-\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 24229,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdGm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffdN \ufffd\u00da\ufffdfy\ufffd<\ufffd!\ufffd\ufffdG\ufffds\ufffd\ufffd45U\u95f4M\ufffd-&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:24229 \u00b7 (reconnaissance)",
"target_port_label": "24229 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 24229,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGm\ufffd\u0016\ufffd\ufffd\u0003\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0005\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffd\u0015\u0015N \ufffd\u00da\ufffdfy\ufffd<\ufffd\u001a!\u0013\u0016\ufffd\ufffd\u001bG\ufffds\ufffd\u0010\ufffd45U\u95f4M\ufffd-\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 24229,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:24229 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdGm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdG]8\ufffdR\ufffd\ufffdr\ufffd9\ufffdN \ufffd\u00da\ufffdfy\ufffd<\ufffd!\ufffd\ufffdG\ufffds\ufffd\ufffd45U\u95f4M\ufffd-&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "24229 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "24229"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24229,
24663
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
23718 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:23718 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23718
Chemin / cible
—
Service
TLS
Payload
� ���hd-�)3K� � A��ڋk>l�"6Ǵ��?S ��� k��� @�y�!�u|.�X�u�"z��7( &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���hd-�)3K� �
A��ڋk>l�"6Ǵ��?S ��� k��� @�y�!�u|.�X�u�"z��7( &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���hd-�)3K� � A��ڋk>l�"6Ǵ��?S ��� k��� @�y�!�u|.�X�u�"z��7( &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��S��M��+d��~V Z�v�M4 ��=
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.816479229838818,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 23718,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ee99fcb74050ffc6bfd745dc38d4037207b85f50",
"event_fingerprint": "1b09b67d6fb4b08f040ca5eb672c40fff5f46d8d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "a02903617aea0e70a1f2354d461503cb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 23718,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffd\ufffdhd-\ufffd)3K\ufffd\u001e\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd\u001d@\ufffdy\ufffd!\b\ufffdu|.\ufffdX\ufffdu\ufffd\"\u0014z\ufffd\ufffd\u00167(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffd\ufffdhd-\ufffd)3K\ufffd\u001e\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd\u001d@\ufffdy\ufffd!\b\ufffdu|.\ufffdX\ufffdu\ufffd\"\u0014z\ufffd\ufffd\u00167(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0013\ufffdS\ufffd\ufffdM\ufffd\ufffd\u061c\u0005+d\ufffd\ufffd~V\rZ\ufffdv\ufffdM\u00174\u001d\ufffd\ufffd=\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffd\ufffdhd-\ufffd)3K\ufffd\u001e\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd\u001d@\ufffdy\ufffd!\b\ufffdu|.\ufffdX\ufffdu\ufffd\"\u0014z\ufffd\ufffd\u00167(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3a3a4db7ebc5e82282ad011e562140a681ec87e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffd\ufffdhd-\ufffd)3K\ufffd\u001e\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd\u001d@\ufffdy\ufffd!\b\ufffdu|.\ufffdX\ufffdu\ufffd\"\u0014z\ufffd\ufffd\u00167(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23718,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdhd-\ufffd)3K\ufffd\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd@\ufffdy\ufffd!\ufffdu|.\ufffdX\ufffdu\ufffd\"z\ufffd\ufffd7(&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:23718 \u00b7 (reconnaissance)",
"target_port_label": "23718 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 23718,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffd\ufffdhd-\ufffd)3K\ufffd\u001e\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd\u001d@\ufffdy\ufffd!\b\ufffdu|.\ufffdX\ufffdu\ufffd\"\u0014z\ufffd\ufffd\u00167(\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23718,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:23718 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdhd-\ufffd)3K\ufffd\ufffd\nA\ufffd\ufffd\u068bk>l\ufffd\"6\u01f4\ufffd\ufffd?S \ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd@\ufffdy\ufffd!\ufffdu|.\ufffdX\ufffdu\ufffd\"z\ufffd\ufffd7(&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "23718 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "23718"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
23437,
23462,
23486,
23718,
24035,
24663
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
23486 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:23486 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23486
Chemin / cible
—
Service
TLS
Payload
� �����-�oj_b�E�e���b���g�� ��M�� �J��`Z�c�S��������%���L �? &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����-�oj_b�E�e���b���g��
��M�� �J��`Z�c�S��������%���L �? &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �����-�oj_b�E�e���b���g�� ��M�� �J��`Z�c�S��������%���L �? &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �B&t�N|��/��� ��p2�L���]`���)
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.861425489082637,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 23486,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2fb4779765165d03f2e5c7967c3c854fb5149e3a",
"event_fingerprint": "e748bb2e39f8d0a6ab6f775d2b3db61f9e847ab2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "85252f81ef13f93c8300fea0b3a7740e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 23486,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\u001b\ufffd \ufffdJ\u000f\ufffd\ufffd`Z\u0003\ufffdc\ufffd\bS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd%\ufffd\ufffd\ufffdL\u001e\u000f\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\u001b\ufffd \ufffdJ\u000f\ufffd\ufffd`Z\u0003\ufffdc\ufffd\bS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd%\ufffd\ufffd\ufffdL\u001e\u000f\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdB&t\ufffdN|\ufffd\ufffd\/\ufffd\ufffd\u0015\ufffd\u000b\ufffd\ufffdp2\ufffd\u001bL\ufffd\ufffd\ufffd]`\u0001\ufffd\ufffd\ufffd)",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\u001b\ufffd \ufffdJ\u000f\ufffd\ufffd`Z\u0003\ufffdc\ufffd\bS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd%\ufffd\ufffd\ufffdL\u001e\u000f\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6500b96baad083d9a11b5b726c19eee3b74f2520",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\u001b\ufffd \ufffdJ\u000f\ufffd\ufffd`Z\u0003\ufffdc\ufffd\bS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd%\ufffd\ufffd\ufffdL\u001e\u000f\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23486,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\ufffd \ufffdJ\ufffd\ufffd`Z\ufffdc\ufffdS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffdL\ufffd?&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:23486 \u00b7 (reconnaissance)",
"target_port_label": "23486 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 23486,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\u001b\ufffd \ufffdJ\u000f\ufffd\ufffd`Z\u0003\ufffdc\ufffd\bS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd%\ufffd\ufffd\ufffdL\u001e\u000f\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23486,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:23486 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffdoj_b\ufffdE\ufffde\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdg\ufffd\ufffd\r\ufffd\ufffdM\ufffd\ufffd \ufffdJ\ufffd\ufffd`Z\ufffdc\ufffdS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffdL\ufffd?&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "23486 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "23486"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
23437,
23462,
23486,
24035,
24663
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.83,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
24663 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:24663 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
24663
Chemin / cible
—
Service
TLS
Payload
� �,?�ϊ���ƅHq`<pf�~W�6�L��� �E�°-��|I���W6�g�kP�� YCD &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �,?�ϊ���ƅHq`<pf�~W�6�L��� �E�°-��|I���W6�g�kP�� YCD &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �,?�ϊ���ƅHq`<pf�~W�6�L��� �E�°-��|I���W6�g�kP�� YCD &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ y�uxV�l(�� \~� W�_���r�ca�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.901463849364989,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 24663,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "14b23cc54ffb02e97a239d795d080327176d7c31",
"event_fingerprint": "a3b20e36f1baa71d5523b337cb5306db0828c718",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "201b4024d171f5627c8bab4a8453e48d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 24663,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd\u0003~W\ufffd6\ufffdL\ufffd\ufffd\u001b\ufffd\u0015\u0010 \ufffdE\ufffd\u001b\u07fc\u0004\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffd\u001fYCD\u0018\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd\u0003~W\ufffd6\ufffdL\ufffd\ufffd\u001b\ufffd\u0015\u0010 \ufffdE\ufffd\u001b\u07fc\u0004\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffd\u001fYCD\u0018\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 y\ufffduxV\ufffdl(\ufffd\ufffd\u001f\\~\ufffd \u000eW\ufffd\u0018_\ufffd\ufffd\ufffdr\u0004\u000e\u0012\ufffdca\ufffd\u0014",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd\u0003~W\ufffd6\ufffdL\ufffd\ufffd\u001b\ufffd\u0015\u0010 \ufffdE\ufffd\u001b\u07fc\u0004\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffd\u001fYCD\u0018\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c8a637296ab91b99e8b3f23623705415bb906ea",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd\u0003~W\ufffd6\ufffdL\ufffd\ufffd\u001b\ufffd\u0015\u0010 \ufffdE\ufffd\u001b\u07fc\u0004\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffd\u001fYCD\u0018\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 24663,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd~W\ufffd6\ufffdL\ufffd\ufffd\ufffd \ufffdE\ufffd\u07fc\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffdYCD&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:24663 \u00b7 (reconnaissance)",
"target_port_label": "24663 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 24663,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd\u0003~W\ufffd6\ufffdL\ufffd\ufffd\u001b\ufffd\u0015\u0010 \ufffdE\ufffd\u001b\u07fc\u0004\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffd\u001fYCD\u0018\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 24663,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:24663 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd,?\ufffd\u03ca\ufffd\ufffd\ufffd\u0185Hq`<pf\ufffd~W\ufffd6\ufffdL\ufffd\ufffd\ufffd \ufffdE\ufffd\u07fc\u00b0-\ufffd\ufffd|I\ufffd\ufffd\ufffdW6\ufffdg\ufffdkP\ufffd\ufffdYCD&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "24663 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "24663"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.76,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
24035 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:24035 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
24035
Chemin / cible
—
Service
TLS
Payload
� ��v��YWyYb�XT�F�X��v�s��r�)Rd� �-&�W-�o)�>�O6Sx� &d!����� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��v��YWyYb�XT�F�X��v�s��r�)Rd� �-&�W-�o)�>�O6Sx� &d!����� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��v��YWyYb�XT�F�X��v�s��r�)Rd� �-&�W-�o)�>�O6Sx� &d!����� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ >o��ale�m����"gRc~���S�|Z V
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.840017220327627,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 24035,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04701c76dd323b7f0390e8a399ef9658110a2dfd",
"event_fingerprint": "c45f12d5d585cb47615bf9c2fb288747176b17ed",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "edec65949d72a6fc066785aca0d7507f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 24035,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdv\ufffd\ufffdYWyYb\ufffdX\u0003T\ufffdF\ufffdX\u0015\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-\u001b&\ufffdW-\ufffdo)\ufffd>\u0013\ufffdO6S\u0002x\ufffd\u001c&d!\ufffd\u0007\ufffd\b\ufffd\u0004\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdv\ufffd\ufffdYWyYb\ufffdX\u0003T\ufffdF\ufffdX\u0015\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-\u001b&\ufffdW-\ufffdo)\ufffd>\u0013\ufffdO6S\u0002x\ufffd\u001c&d!\ufffd\u0007\ufffd\b\ufffd\u0004\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0016>o\ufffd\ufffdale\ufffdm\ufffd\ufffd\ufffd\ufffd\"gR\u000fc~\ufffd\ufffd\ufffdS\u0012\ufffd|Z\u0010\u001b\u001eV",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdv\ufffd\ufffdYWyYb\ufffdX\u0003T\ufffdF\ufffdX\u0015\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-\u001b&\ufffdW-\ufffdo)\ufffd>\u0013\ufffdO6S\u0002x\ufffd\u001c&d!\ufffd\u0007\ufffd\b\ufffd\u0004\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1c08568d1942b0d9f542a3f2e0a8560480bd9b7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdv\ufffd\ufffdYWyYb\ufffdX\u0003T\ufffdF\ufffdX\u0015\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-\u001b&\ufffdW-\ufffdo)\ufffd>\u0013\ufffdO6S\u0002x\ufffd\u001c&d!\ufffd\u0007\ufffd\b\ufffd\u0004\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 24035,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffd\ufffdYWyYb\ufffdXT\ufffdF\ufffdX\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-&\ufffdW-\ufffdo)\ufffd>\ufffdO6Sx\ufffd&d!\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:24035 \u00b7 (reconnaissance)",
"target_port_label": "24035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 24035,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdv\ufffd\ufffdYWyYb\ufffdX\u0003T\ufffdF\ufffdX\u0015\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-\u001b&\ufffdW-\ufffdo)\ufffd>\u0013\ufffdO6S\u0002x\ufffd\u001c&d!\ufffd\u0007\ufffd\b\ufffd\u0004\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 24035,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:24035 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffd\ufffdYWyYb\ufffdXT\ufffdF\ufffdX\ufffd\ufffdv\ufffds\ufffd\ufffdr\ufffd)Rd\ufffd \ufffd-&\ufffdW-\ufffdo)\ufffd>\ufffdO6Sx\ufffd&d!\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "24035 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "24035"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
23437,
23462,
24035,
24663
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.88,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
23462 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:23462 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23462
Chemin / cible
—
Service
TLS
Payload
� ��f/F� �]U�����9{ �\#!�U��� .�7ݵ-��ʞI��p���y�������M��IS &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��f/F�
�]U�����9{
�\#!�U��� .�7ݵ-��ʞI��p���y�������M��IS &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��f/F� �]U�����9{ �\#!�U��� .�7ݵ-��ʞI��p���y�������M��IS &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �[�!��p-�8�B�9/�Z,h�h�ur��z��
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8172900556142455,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 23462,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8025ac62ba306bc4ca98b03041e97395ef9f2a8b",
"event_fingerprint": "c0447ab997541796d00ba2eaa4a454f24f66c54a",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "6ebf9c78651adc9b0432889bfc58f921",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 23462,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdf\u000f\/F\ufffd\u0005\n\ufffd\u0012]U\ufffd\ufffd\ufffd\ufffd\u0005\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdf\u000f\/F\ufffd\u0005\n\ufffd\u0012]U\ufffd\ufffd\ufffd\ufffd\u0005\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd[\u0017\ufffd!\ufffd\ufffdp-\ufffd8\ufffdB\ufffd9\/\ufffdZ,h\ufffdh\ufffdur\ufffd\ufffdz\ufffd\ufffd ",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdf\u000f\/F\ufffd\u0005\n\ufffd\u0012]U\ufffd\ufffd\ufffd\ufffd\u0005\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4396ad539905ce5238eebddaf127eb1a86571fba",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdf\u000f\/F\ufffd\u0005\n\ufffd\u0012]U\ufffd\ufffd\ufffd\ufffd\u0005\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23462,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdf\/F\ufffd\n\ufffd]U\ufffd\ufffd\ufffd\ufffd\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:23462 \u00b7 (sonde \/ probe)",
"target_port_label": "23462 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 23462,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdf\u000f\/F\ufffd\u0005\n\ufffd\u0012]U\ufffd\ufffd\ufffd\ufffd\u0005\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23462,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:23462 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdf\/F\ufffd\n\ufffd]U\ufffd\ufffd\ufffd\ufffd\ufffd9{\r\ufffd\\#!\ufffdU\ufffd\ufffd\ufffd .\ufffd7\u0775-\ufffd\ufffd\u029eI\ufffd\ufffdp\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffdIS&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "23462 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "23462"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
23437 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:23437 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23437
Chemin / cible
—
Service
TLS
Payload
� �/��^4��&�O�ȉ�Xl�, ���H���� �������O &� '������Fw ����Wb &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �/��^4��&�O�ȉ�Xl�, ���H���� �������O &� '������Fw
����Wb &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �/��^4��&�O�ȉ�Xl�, ���H���� �������O &� '������Fw ����Wb &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��y�V��Q��żW��j��w>�q�?��%
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8218592454244815,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 23437,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e6ecd641e436a25e7d1dff29a86ff189af4975ee",
"event_fingerprint": "a54d31e07c99d76b8742d7834d5f5c4fcff39ca1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "cd924e0d6630126d9d80bea8e414a62a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 23437,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u0016\ufffd\u0016\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\f\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \u0016\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdO\f&\ufffd\u001c'\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u0016\ufffd\u0016\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\f\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \u0016\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdO\f&\ufffd\u001c'\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u07b9y\ufffdV\ufffd\ufffdQ\ufffd\ufffd\u017c\u0015W\ufffd\b\ufffdj\ufffd\ufffdw>\ufffdq\ufffd?\ufffd\ufffd%",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u0016\ufffd\u0016\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\f\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \u0016\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdO\f&\ufffd\u001c'\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68598568feeec686a46e6cda1d32caba4d098dae",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u0016\ufffd\u0016\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\f\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \u0016\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdO\f&\ufffd\u001c'\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23437,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO&\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:23437 \u00b7 (sonde \/ probe)",
"target_port_label": "23437 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 23437,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\u0016\ufffd\u0016\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\f\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \u0016\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdO\f&\ufffd\u001c'\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 23437,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:23437 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\/\ufffd\ufffd^4\ufffd\ufffd&\ufffdO\ufffd\u0209\ufffdXl\ufffd,\ufffd\ufffd\ufffd\u05ebH\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO&\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdFw\n\ufffd\ufffd\ufffd\ufffdWb&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "23437 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "23437"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19169 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19169 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19169
Chemin / cible
—
Service
TLS
Payload
� �g?N+�|����?��^J_�ӕ�{V�M��g�� �M5�i&a[=Q9Ԩe0jq���5e���� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �g?N+�|����?��^J_�ӕ�{V�M��g�� �M5�i&a[=Q9Ԩe0jq���5e���� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �g?N+�|����?��^J_�ӕ�{V�M��g�� �M5�i&a[=Q9Ԩe0jq���5e���� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��rU��$B�BE�nK���+y��Q��Jp�N�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8409581622994855,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19169,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "19dfa0589c4c66e484f8babf6885429bc50dbd9f",
"event_fingerprint": "88cd9cdc1b77fb99b47cbecd3ffb6571802159d9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "903a0d82d62380a7384c55cebb361284",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19169,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g?N+\ufffd|\ufffd\ufffd\ufffd\ufffd\u0019?\ufffd\ufffd\u0015^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffd\u001aM5\ufffdi\u0002&a[=Q9\u0528e0j\u0018q\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\u000f\ufffd\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g?N+\ufffd|\ufffd\ufffd\ufffd\ufffd\u0019?\ufffd\ufffd\u0015^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffd\u001aM5\ufffdi\u0002&a[=Q9\u0528e0j\u0018q\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\u000f\ufffd\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b\ufffd\ufffdrU\ufffd\ufffd$B\ufffdBE\ufffdnK\ufffd\ufffd\ufffd+y\ufffd\ufffdQ\ufffd\ufffdJp\ufffdN\ufffd\r",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g?N+\ufffd|\ufffd\ufffd\ufffd\ufffd\u0019?\ufffd\ufffd\u0015^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffd\u001aM5\ufffdi\u0002&a[=Q9\u0528e0j\u0018q\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\u000f\ufffd\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8b4f08b8667701bd521b7cb1a7fab4c6c614fc8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g?N+\ufffd|\ufffd\ufffd\ufffd\ufffd\u0019?\ufffd\ufffd\u0015^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffd\u001aM5\ufffdi\u0002&a[=Q9\u0528e0j\u0018q\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\u000f\ufffd\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19169,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdg?N+\ufffd|\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffdM5\ufffdi&a[=Q9\u0528e0jq\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19169 \u00b7 (reconnaissance)",
"target_port_label": "19169 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19169,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g?N+\ufffd|\ufffd\ufffd\ufffd\ufffd\u0019?\ufffd\ufffd\u0015^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffd\u001aM5\ufffdi\u0002&a[=Q9\u0528e0j\u0018q\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\u000f\ufffd\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19169,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19169 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdg?N+\ufffd|\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd^J_\ufffd\u04d5\ufffd{V\ufffdM\ufffd\ufffdg\ufffd\ufffd \ufffdM5\ufffdi&a[=Q9\u0528e0jq\ufffd\ufffd\ufffd5e\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19169 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19169"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
18650,
18730,
18967,
19071,
19169,
19248,
19388,
19455
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 4.26,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19248 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19248 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19248
Chemin / cible
—
Service
TLS
Payload
� ��5s�� ��T*�՜n����0�4K�1@ � �Ð���߸��+�aH�nK>�ݰe����Ȓ� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��5s�� ��T*�՜n����0�4K�1@ � �Ð���߸��+�aH�nK>�ݰe����Ȓ� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��5s�� ��T*�՜n����0�4K�1@ � �Ð���߸��+�aH�nK>�ݰe����Ȓ� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ܖ�1v|-�#���:8s���-&�x O6��
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.8665246518519325,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19248,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c674deb3956b2bd24767be0eabdbdb9c97149306",
"event_fingerprint": "2b87e25006ffb7a796093afc6c2c9ba9e0601562",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "6a5a637e0e2df95f7b02f4d5c80ec99a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19248,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd5s\ufffd\ufffd\u001f\ufffd\ufffdT*\ufffd\u055cn\ufffd\u0019\ufffd\ufffd\ufffd0\ufffd4\u0002K\u0010\ufffd1@\u001e\u000b\ufffd\u0006 \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\u001b\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd5s\ufffd\ufffd\u001f\ufffd\ufffdT*\ufffd\u055cn\ufffd\u0019\ufffd\ufffd\ufffd0\ufffd4\u0002K\u0010\ufffd1@\u001e\u000b\ufffd\u0006 \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\u001b\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0716\ufffd\u00061v|-\u0010\u0003\ufffd#\ufffd\ufffd\ufffd:8s\ufffd\ufffd\ufffd-&\ufffd\u0014x\u001cO6\ufffd\ufffd\r",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd5s\ufffd\ufffd\u001f\ufffd\ufffdT*\ufffd\u055cn\ufffd\u0019\ufffd\ufffd\ufffd0\ufffd4\u0002K\u0010\ufffd1@\u001e\u000b\ufffd\u0006 \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\u001b\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "315befe9ea905b7e526a42a9bc6ccd500cf9c0e9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd5s\ufffd\ufffd\u001f\ufffd\ufffdT*\ufffd\u055cn\ufffd\u0019\ufffd\ufffd\ufffd0\ufffd4\u0002K\u0010\ufffd1@\u001e\u000b\ufffd\u0006 \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\u001b\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19248,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd5s\ufffd\ufffd\ufffd\ufffdT*\ufffd\u055cn\ufffd\ufffd\ufffd\ufffd0\ufffd4K\ufffd1@\ufffd \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19248 \u00b7 (reconnaissance)",
"target_port_label": "19248 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19248,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd5s\ufffd\ufffd\u001f\ufffd\ufffdT*\ufffd\u055cn\ufffd\u0019\ufffd\ufffd\ufffd0\ufffd4\u0002K\u0010\ufffd1@\u001e\u000b\ufffd\u0006 \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\u001b\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19248,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19248 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd5s\ufffd\ufffd\ufffd\ufffdT*\ufffd\u055cn\ufffd\ufffd\ufffd\ufffd0\ufffd4K\ufffd1@\ufffd \ufffd\u00d0\ufffd\ufffd\ufffd\u07f8\ufffd\ufffd+\ufffdaH\ufffdnK>\ufffd\u0770e\ufffd\ufffd\ufffd\ufffd\u0212\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19248 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19248"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
18650,
18730,
18967,
19071,
19248,
19455
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19388 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19388 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19388
Chemin / cible
—
Service
TLS
Payload
� �Sk�9M�����В �~ �����m.V��Y ���eX��c�\R��s� �?�[d��F� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Sk�9M����� �~ �����m.V��Y ���eX��c�\R��s�
�?�[d��F� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �Sk�9M�����В �~ �����m.V��Y ���eX��c�\R��s� �?�[d��F� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �s�j�<�$ F�Uu����� �ʧ�H��T�Yl
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.786354926837229,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19388,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "efc68292335f4268fe0d28b3d21c61b96b39491e",
"event_fingerprint": "93a5d26fe7d269cd4e67b0d8aabb1af6bd245b96",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "4e1d0f35599251958af1a73ce08dfa51",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19388,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Sk\ufffd\u00049M\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u0412\u001d\u0014\ufffd~\f\ufffd\ufffd\ufffd\ufffd\ufffd\u0016m.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\u0015\ufffd\ufffdc\u000e\ufffd\\R\u0019\ufffd\u0014\ufffds\ufffd\n\ufffd?\u0007\ufffd[d\ufffd\ufffd\u000fF\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Sk\ufffd\u00049M\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u0412\u001d\u0014\ufffd~\f\ufffd\ufffd\ufffd\ufffd\ufffd\u0016m.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\u0015\ufffd\ufffdc\u000e\ufffd\\R\u0019\ufffd\u0014\ufffds\ufffd\n\ufffd?\u0007\ufffd[d\ufffd\ufffd\u000fF\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffds\ufffdj\ufffd<\ufffd$\fF\ufffdUu\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u02a7\ufffdH\ufffd\ufffdT\ufffdY\u0002l",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Sk\ufffd\u00049M\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u0412\u001d\u0014\ufffd~\f\ufffd\ufffd\ufffd\ufffd\ufffd\u0016m.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\u0015\ufffd\ufffdc\u000e\ufffd\\R\u0019\ufffd\u0014\ufffds\ufffd\n\ufffd?\u0007\ufffd[d\ufffd\ufffd\u000fF\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b7b7306348a2d3b66a0ac1750aec34472824c65",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Sk\ufffd\u00049M\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u0412\u001d\u0014\ufffd~\f\ufffd\ufffd\ufffd\ufffd\ufffd\u0016m.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\u0015\ufffd\ufffdc\u000e\ufffd\\R\u0019\ufffd\u0014\ufffds\ufffd\n\ufffd?\u0007\ufffd[d\ufffd\ufffd\u000fF\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19388,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdSk\ufffd9M\ufffd\ufffd\ufffd\ufffd\ufffd\u0412\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdm.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\ufffd\ufffdc\ufffd\\R\ufffd\ufffds\ufffd\n\ufffd?\ufffd[d\ufffd\ufffdF\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19388 \u00b7 (reconnaissance)",
"target_port_label": "19388 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19388,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Sk\ufffd\u00049M\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\u0412\u001d\u0014\ufffd~\f\ufffd\ufffd\ufffd\ufffd\ufffd\u0016m.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\u0015\ufffd\ufffdc\u000e\ufffd\\R\u0019\ufffd\u0014\ufffds\ufffd\n\ufffd?\u0007\ufffd[d\ufffd\ufffd\u000fF\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19388,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19388 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdSk\ufffd9M\ufffd\ufffd\ufffd\ufffd\ufffd\u0412\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdm.V\ufffd\ufffdY \ufffd\ufffd\ufffdeX\ufffd\ufffdc\ufffd\\R\ufffd\ufffds\ufffd\n\ufffd?\ufffd[d\ufffd\ufffdF\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19388 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
18650,
18730,
18967,
19071,
19248,
19388,
19455
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19071 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:19071 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19071
Chemin / cible
—
Service
TLS
Payload
� �:X�3� s��1��'-�_��� �ؿ� � �=<� �ڳ���S���Ҥ.x1]�6ȸ�3 �kJ X�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �:X�3� s��1��'-�_��� �ؿ� � �=<� �ڳ���S���Ҥ.x1]�6ȸ�3 �kJ X�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �:X�3� s��1��'-�_��� �ؿ� � �=<� �ڳ���S���Ҥ.x1]�6ȸ�3 �kJ X�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��Tǀ�� �{M���N���%j�͑;&a
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.768227324725024,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19071,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "19c7866d93bc86cc0cec37c130724e791070c161",
"event_fingerprint": "19ef0f94b6741e1f1f3ca20f8cab7821bbb9fd30",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "07ed799e1a68e9d3357b9c5d99631d1c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19071,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003:X\ufffd3\ufffd\fs\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\u0000\ufffd\u063f\ufffd\u000b\ufffd\u001d\ufffd=\u0017<\ufffd \ufffd\u06b3\ufffd\ufffd\u0012\ufffdS\ufffd\ufffd\ufffd\u04a4\u0019.x1]\ufffd6\u0238\ufffd3\u001d\ufffdkJ\fX\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003:X\ufffd3\ufffd\fs\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\u0000\ufffd\u063f\ufffd\u000b\ufffd\u001d\ufffd=\u0017<\ufffd \ufffd\u06b3\ufffd\ufffd\u0012\ufffdS\ufffd\ufffd\ufffd\u04a4\u0019.x1]\ufffd6\u0238\ufffd3\u001d\ufffdkJ\fX\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0011\u0007\ufffd\u0006T\u01c0\ufffd\ufffd\u001f\ufffd\u0018{M\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffd\u0003%j\ufffd\u0351;&a ",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003:X\ufffd3\ufffd\fs\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\u0000\ufffd\u063f\ufffd\u000b\ufffd\u001d\ufffd=\u0017<\ufffd \ufffd\u06b3\ufffd\ufffd\u0012\ufffdS\ufffd\ufffd\ufffd\u04a4\u0019.x1]\ufffd6\u0238\ufffd3\u001d\ufffdkJ\fX\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1540a1fa9ac99f4be642735b93c7238a1cef48e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003:X\ufffd3\ufffd\fs\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\u0000\ufffd\u063f\ufffd\u000b\ufffd\u001d\ufffd=\u0017<\ufffd \ufffd\u06b3\ufffd\ufffd\u0012\ufffdS\ufffd\ufffd\ufffd\u04a4\u0019.x1]\ufffd6\u0238\ufffd3\u001d\ufffdkJ\fX\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19071,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd:X\ufffd3\ufffds\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\ufffd\u063f\ufffd\ufffd\ufffd=<\ufffd \ufffd\u06b3\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffd\u04a4.x1]\ufffd6\u0238\ufffd3\ufffdkJX\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:19071 \u00b7 (reconnaissance)",
"target_port_label": "19071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19071,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003:X\ufffd3\ufffd\fs\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\u0000\ufffd\u063f\ufffd\u000b\ufffd\u001d\ufffd=\u0017<\ufffd \ufffd\u06b3\ufffd\ufffd\u0012\ufffdS\ufffd\ufffd\ufffd\u04a4\u0019.x1]\ufffd6\u0238\ufffd3\u001d\ufffdkJ\fX\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19071,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19071 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd:X\ufffd3\ufffds\ufffd\ufffd1\ufffd\ufffd'-\ufffd_\ufffd\ufffd\ufffd\ufffd\u063f\ufffd\ufffd\ufffd=<\ufffd \ufffd\u06b3\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffd\u04a4.x1]\ufffd6\u0238\ufffd3\ufffdkJX\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19071 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19071"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
18650,
18730,
18967,
19071,
19455
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.91,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18967 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18967 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18967
Chemin / cible
—
Service
TLS
Payload
� ��-DcI!S�s��@�aH�KW�� u_��� H �} mqS� @Z�9� ]ƅ���;���^ &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��-DcI!S�s��@�aH�KW��
u_��� H �}
mqS� @Z�9� ]ƅ���;���^ &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��-DcI!S�s��@�aH�KW�� u_��� H �} mqS� @Z�9� ]ƅ���;���^ &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ah2� �M���ט[C�(��Fҩ�5�fJ;-�4_
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.819220020852985,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18967,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "02d4dca921389406561150beecec948a9e25e6df",
"event_fingerprint": "645eec32b4be7e11807b5cf89566466022e9d49e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "2deca320ed4c0fa7a6f4485659c00ce8",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18967,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffd\u001baH\ufffdKW\ufffd\ufffd\n\u000fu_\ufffd\ufffd\u0010\ufffd\fH \ufffd}\nmqS\ufffd \u0000@Z\ufffd9\ufffd\u001c]\u0185\ufffd\ufffd\ufffd\u0012;\ufffd\u0017\ufffd\ufffd\u05ce\u0014^\u001a\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffd\u001baH\ufffdKW\ufffd\ufffd\n\u000fu_\ufffd\ufffd\u0010\ufffd\fH \ufffd}\nmqS\ufffd \u0000@Z\ufffd9\ufffd\u001c]\u0185\ufffd\ufffd\ufffd\u0012;\ufffd\u0017\ufffd\ufffd\u05ce\u0014^\u001a\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ah2\ufffd\u0000\ufffdM\ufffd\ufffd\ufffd\u05d8[C\ufffd(\ufffd\ufffdF\u04a9\ufffd5\ufffdfJ;-\ufffd4_",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffd\u001baH\ufffdKW\ufffd\ufffd\n\u000fu_\ufffd\ufffd\u0010\ufffd\fH \ufffd}\nmqS\ufffd \u0000@Z\ufffd9\ufffd\u001c]\u0185\ufffd\ufffd\ufffd\u0012;\ufffd\u0017\ufffd\ufffd\u05ce\u0014^\u001a\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9cad060dddf56a80d02a12b0686c2c549b3cbe3a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffd\u001baH\ufffdKW\ufffd\ufffd\n\u000fu_\ufffd\ufffd\u0010\ufffd\fH \ufffd}\nmqS\ufffd \u0000@Z\ufffd9\ufffd\u001c]\u0185\ufffd\ufffd\ufffd\u0012;\ufffd\u0017\ufffd\ufffd\u05ce\u0014^\u001a\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18967,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffdaH\ufffdKW\ufffd\ufffd\nu_\ufffd\ufffd\ufffdH \ufffd}\nmqS\ufffd @Z\ufffd9\ufffd]\u0185\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u05ce^&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18967 \u00b7 (reconnaissance)",
"target_port_label": "18967 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18967,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffd\u001baH\ufffdKW\ufffd\ufffd\n\u000fu_\ufffd\ufffd\u0010\ufffd\fH \ufffd}\nmqS\ufffd \u0000@Z\ufffd9\ufffd\u001c]\u0185\ufffd\ufffd\ufffd\u0012;\ufffd\u0017\ufffd\ufffd\u05ce\u0014^\u001a\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18967,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18967 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd-DcI!S\ufffds\ufffd\ufffd@\ufffdaH\ufffdKW\ufffd\ufffd\nu_\ufffd\ufffd\ufffdH \ufffd}\nmqS\ufffd @Z\ufffd9\ufffd]\u0185\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\u05ce^&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18967 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18967"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.72,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18650 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:18650 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18650
Chemin / cible
—
Service
TLS
Payload
� ���w�Li����8���?4�"�����I�;���� X��0��a�(���<r���-��KKr���� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���w�Li����8���?4�"�����I�;���� X��0��a�(���<r���-��KKr���� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���w�Li����8���?4�"�����I�;���� X��0��a�(���<r���-��KKr���� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ G ���d a1"q9@�Dy ���(�au�_�zS
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.776308400662718,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18650,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f3bb90a41f705bfd777ad191e9ad7d736f6628c3",
"event_fingerprint": "ea601a8b83b12ca79eea15a315e1e14b828a34b0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "5e73ac2d4ff58849ee0671968a660006",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18650,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd\u00028\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\u0004\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\u0019\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\b\ufffd\u0018<r\ufffd\ufffd\ufffd-\ufffd\ufffd\u0013KKr\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd\u00028\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\u0004\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\u0019\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\b\ufffd\u0018<r\ufffd\ufffd\ufffd-\ufffd\ufffd\u0013KKr\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 G\u0000\ufffd\ufffd\ufffdd\n\u0007a1\"q9@\ufffdDy\u001c\ufffd\ufffd\ufffd(\ufffdau\ufffd\u0001\u000f_\ufffdzS",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd\u00028\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\u0004\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\u0019\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\b\ufffd\u0018<r\ufffd\ufffd\ufffd-\ufffd\ufffd\u0013KKr\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf1c3590db80d985553d2ff1767c2205e6656aa4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd\u00028\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\u0004\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\u0019\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\b\ufffd\u0018<r\ufffd\ufffd\ufffd-\ufffd\ufffd\u0013KKr\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18650,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\ufffd<r\ufffd\ufffd\ufffd-\ufffd\ufffdKKr\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:18650 \u00b7 (reconnaissance)",
"target_port_label": "18650 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18650,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd\u00028\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\u0004\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\u0019\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\b\ufffd\u0018<r\ufffd\ufffd\ufffd-\ufffd\ufffd\u0013KKr\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18650,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:18650 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdw\ufffdLi\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd?4\ufffd\"\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd;\ufffd\ufffd\ufffd\ufffd X\ufffd\ufffd0\ufffd\ufffda\ufffd(\ufffd\ufffd\ufffd<r\ufffd\ufffd\ufffd-\ufffd\ufffdKKr\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18650 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18650"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
18650,
18730,
18967,
19455
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.88,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18730 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:18730 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18730
Chemin / cible
—
Service
TLS
Payload
� �9�N^��sX� 9&"��H; ��z(���&k�'� ԓ� �����Ǧ���҄��d�x��O &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9�N^��sX� 9&"��H; ��z(���&k�'� ԓ� �����Ǧ���҄��d�x��O &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �9�N^��sX� 9&"��H; ��z(���&k�'� ԓ� �����Ǧ���҄��d�x��O &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ f���$~��_wS:l)���Q�ݕ�ԩ�v�]V�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.782958781537294,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18730,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0d8dbc108275c82c4b8ddc5df7391d751a27e036",
"event_fingerprint": "3d0df692d2ba7c8f5c3cb508501f6cc216388329",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "648455662da8eaf3218b421c9d2289cd",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18730,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffdN^\u001b\ufffd\ufffdsX\ufffd\f9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd\u0012'\ufffd \u0005\u0513\b\ufffd\u001d\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u01e6\u0004\u000f\ufffd\u0005\ufffd\u0004\ufffd\u0484\ufffd\ufffdd\ufffdx\u0005\ufffd\ufffdO\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffdN^\u001b\ufffd\ufffdsX\ufffd\f9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd\u0012'\ufffd \u0005\u0513\b\ufffd\u001d\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u01e6\u0004\u000f\ufffd\u0005\ufffd\u0004\ufffd\u0484\ufffd\ufffdd\ufffdx\u0005\ufffd\ufffdO\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 f\ufffd\ufffd\ufffd$~\ufffd\ufffd_wS:l)\ufffd\ufffd\ufffdQ\ufffd\u0755\ufffd\u0529\ufffdv\ufffd]V\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffdN^\u001b\ufffd\ufffdsX\ufffd\f9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd\u0012'\ufffd \u0005\u0513\b\ufffd\u001d\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u01e6\u0004\u000f\ufffd\u0005\ufffd\u0004\ufffd\u0484\ufffd\ufffdd\ufffdx\u0005\ufffd\ufffdO\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "050672676b10582b054eb0ab04f571844d236f88",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffdN^\u001b\ufffd\ufffdsX\ufffd\f9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd\u0012'\ufffd \u0005\u0513\b\ufffd\u001d\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u01e6\u0004\u000f\ufffd\u0005\ufffd\u0004\ufffd\u0484\ufffd\ufffdd\ufffdx\u0005\ufffd\ufffdO\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18730,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd9\ufffdN^\ufffd\ufffdsX\ufffd9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd'\ufffd \u0513\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01e6\ufffd\ufffd\ufffd\u0484\ufffd\ufffdd\ufffdx\ufffd\ufffdO&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:18730 \u00b7 (sonde \/ probe)",
"target_port_label": "18730 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18730,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffdN^\u001b\ufffd\ufffdsX\ufffd\f9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd\u0012'\ufffd \u0005\u0513\b\ufffd\u001d\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u01e6\u0004\u000f\ufffd\u0005\ufffd\u0004\ufffd\u0484\ufffd\ufffdd\ufffdx\u0005\ufffd\ufffdO\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18730,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:18730 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd9\ufffdN^\ufffd\ufffdsX\ufffd9&\"\ufffd\ufffdH;\t\ufffd\ufffdz(\ufffd\ufffd\ufffd&k\ufffd'\ufffd \u0513\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01e6\ufffd\ufffd\ufffd\u0484\ufffd\ufffdd\ufffdx\ufffd\ufffdO&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18730 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18730"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
19455 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:19455 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19455
Chemin / cible
—
Service
TLS
Payload
� �N?��p<D��u+����|�3Y� �����' ��^ k@��-͛�uPG/�CXh>3�p &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N?��p<D��u+����|�3Y� �����' ��^
k@��-͛�uPG/�CXh>3�p &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �N?��p<D��u+����|�3Y� �����' ��^ k@��-͛�uPG/�CXh>3�p &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �SP8��"Ҍ������>�B�3�B���R�j;A
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.864827582298579,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 19455,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4dd084a3e3e257aac84787150b3d7cb95c07d9b8",
"event_fingerprint": "8474f036ecef882e4e1e85a063954094ba5d542b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "a31f3a4d30003bf78786c458f15e02bd",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19455,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N?\ufffd\ufffd\u0016p<D\ufffd\ufffdu+\u0016\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\u0016\u001e\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\n\u0007k@\ufffd\ufffd-\u000f\u035b\u000f\ufffduPG\/\ufffdC\u000e\u0010Xh>3\ufffd\u0011p\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N?\ufffd\ufffd\u0016p<D\ufffd\ufffdu+\u0016\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\u0016\u001e\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\n\u0007k@\ufffd\ufffd-\u000f\u035b\u000f\ufffduPG\/\ufffdC\u000e\u0010Xh>3\ufffd\u0011p\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdS\u0006P8\ufffd\ufffd\"\u048c\ufffd\u001a\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffdB\ufffd3\ufffdB\ufffd\ufffd\ufffdR\ufffdj;A",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N?\ufffd\ufffd\u0016p<D\ufffd\ufffdu+\u0016\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\u0016\u001e\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\n\u0007k@\ufffd\ufffd-\u000f\u035b\u000f\ufffduPG\/\ufffdC\u000e\u0010Xh>3\ufffd\u0011p\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d856427a3fd0794d0d5b08d696d2bae664a6642e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N?\ufffd\ufffd\u0016p<D\ufffd\ufffdu+\u0016\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\u0016\u001e\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\n\u0007k@\ufffd\ufffd-\u000f\u035b\u000f\ufffduPG\/\ufffdC\u000e\u0010Xh>3\ufffd\u0011p\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19455,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdN?\ufffd\ufffdp<D\ufffd\ufffdu+\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\nk@\ufffd\ufffd-\u035b\ufffduPG\/\ufffdCXh>3\ufffdp&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:19455 \u00b7 (sonde \/ probe)",
"target_port_label": "19455 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19455,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N?\ufffd\ufffd\u0016p<D\ufffd\ufffdu+\u0016\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\u0016\u001e\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\n\u0007k@\ufffd\ufffd-\u000f\u035b\u000f\ufffduPG\/\ufffdC\u000e\u0010Xh>3\ufffd\u0011p\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 19455,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:19455 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdN?\ufffd\ufffdp<D\ufffd\ufffdu+\ufffd\ufffd\ufffd\ufffd|\ufffd3Y\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd' \ufffd\ufffd^\nk@\ufffd\ufffd-\u035b\ufffduPG\/\ufffdCXh>3\ufffdp&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "19455 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19455"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
17657
|
—
|
Sonde port
Sonde port · port 17657 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17657
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 17657,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "632d2d4703f7534f3b48271d79d9cc19a2d86544",
"event_fingerprint": "cb32b5564f6c3f0f194d4ef12ae67bf2c2b4e640",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 17657,
"risk_score": 33
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e45ddd655efed1644c72a1827a87b6751721d9c",
"protocol_details": {
"port": 17657
},
"attack_vector": "Sonde port \u00b7 port 17657 \u00b7 (sonde \/ probe)",
"target_port_label": "17657",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 17657,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 17657
},
"attack_vector": "Sonde port \u00b7 port 17657 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "17657",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17657"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:16913",
"port:17657"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
16913
|
—
|
Sonde port
Sonde port · port 16913 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
16913
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 16913,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "630c7afc9c5f7248a553b1739b06dffe68b2914b",
"event_fingerprint": "3dfde7c809045c3133275dd2cce5c9ebc5405c9d",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 16913,
"risk_score": 44
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55325c1a15573ac00fd7fa980502daad21251555",
"protocol_details": {
"port": 16913
},
"attack_vector": "Sonde port \u00b7 port 16913 \u00b7 (sonde \/ probe)",
"target_port_label": "16913",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 16913,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 16913
},
"attack_vector": "Sonde port \u00b7 port 16913 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "16913",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "16913"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
13419 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:13419 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13419
Chemin / cible
—
Service
TLS
Payload
� ��K��F�����&k���U ����b��8EFjU�� pe���d�c� #6�a��ۆ�UNZ��X �3B &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��K��F�����&k���U ����b��8EFjU�� pe���d�c�
#6�a��ۆ�UNZ��X
�3B &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��K��F�����&k���U ����b��8EFjU�� pe���d�c� #6�a��ۆ�UNZ��X �3B &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �C��v�r�D3s�������_y���t_3
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.842350565510667,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 13419,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c36afb3c5aa5a31b4c8f0a78d082bac9c614b1e1",
"event_fingerprint": "19de5fa9d91adb635dab40838181a5928c24d280",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "6e492f48fe62d07d85cb10acc0d7830c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 13419,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\u001f\r\ufffd3B\u0004\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\u001f\r\ufffd3B\u0004\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdC\ufffd\ufffdv\ufffd\u0015r\u0019\ufffdD3\u0010s\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_y\ufffd\ufffd\ufffdt\u0002_3",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\u001f\r\ufffd3B\u0004\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1179edeb520d55711f9de83a663aedba064d827c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\u001f\r\ufffd3B\u0004\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13419,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\r\ufffd3B&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:13419 \u00b7 (sonde \/ probe)",
"target_port_label": "13419 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 13419,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\u001f\r\ufffd3B\u0004\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13419,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:13419 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffd&k\ufffd\ufffd\ufffdU \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd8EFjU\ufffd\ufffd pe\ufffd\ufffd\ufffdd\ufffdc\ufffd\n#6\ufffda\ufffd\ufffd\u06c6\ufffdUNZ\ufffd\ufffdX\r\ufffd3B&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "13419 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "13419"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
17247
|
—
|
Sonde port
Sonde port · port 17247 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17247
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 17247,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "73b3d5346b92f0a99dc977dff6228d9d4821edfb",
"event_fingerprint": "462d64753bed2fec53c06e3f3515bba9038503d2",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 17247,
"risk_score": 33
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8463d7cf6d5b92176c071ab85dfb542b5c284efe",
"protocol_details": {
"payload_preview": "00000000",
"port": 17247
},
"evidence_snippet": "00000000",
"attack_vector": "Sonde port \u00b7 port 17247 \u00b7 (sonde \/ probe)",
"target_port_label": "17247",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 17247,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "00000000",
"port": 17247
},
"attack_vector": "Sonde port \u00b7 port 17247 \u00b7 (sonde \/ probe)",
"evidence_snippet": "00000000",
"target_port_label": "17247",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17247"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:17247",
"port:17527"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
17527
|
—
|
Sonde port
Sonde port · port 17527 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17527
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 17527,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2d91b531bbaa8b5f612d5730044d553d1366a080",
"event_fingerprint": "3322384bbee67ecd3552ad41abfdcc86c02e1e02",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 17527,
"risk_score": 44
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff24d63fbe7e7d9beca6a59cdd866101e599b8be",
"protocol_details": {
"payload_preview": "00000000",
"port": 17527
},
"evidence_snippet": "00000000",
"attack_vector": "Sonde port \u00b7 port 17527 \u00b7 (sonde \/ probe)",
"target_port_label": "17527",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 17527,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "00000000",
"port": 17527
},
"attack_vector": "Sonde port \u00b7 port 17527 \u00b7 (sonde \/ probe)",
"evidence_snippet": "00000000",
"target_port_label": "17527",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17527"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
15583 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:15583 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15583
Chemin / cible
—
Service
TLS
Payload
� � �L���yp�E�G}�YVe�WVi'� ���(��� �ϱ�Ϡ�>���zYoY�V��v��|Qd��$0Gq� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �L���yp�E�G}�YVe�WVi'� ���(��� �ϱ�Ϡ�>���zYoY�V��v��|Qd��$0Gq� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� � �L���yp�E�G}�YVe�WVi'� ���(��� �ϱ�Ϡ�>���zYoY�V��v��|Qd��$0Gq� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ���f3M�r<k���7� �Lu�A�I ������v
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.903284281755148,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 15583,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "85b62b097d8a7356e483762124f0bb7e75a9ae99",
"event_fingerprint": "2bf35a78e870082b9c221b9c90a5ae922dc30e8a",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "ceb809193f4fa6e33e3f7942473cd505",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 15583,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\u001d\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\u001d\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdf3M\ufffdr<k\ufffd\ufffd\ufffd7\ufffd\u001f\ufffdLu\ufffdA\ufffdI\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\u001d\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88d26643ae19fba2c62eed7de39fb69e1f3c7123",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\u001d\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 15583,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:15583 \u00b7 (sonde \/ probe)",
"target_port_label": "15583 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 15583,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\u001d\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 15583,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:15583 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\t\ufffdL\ufffd\ufffd\ufffdyp\ufffdE\ufffdG}\ufffdYVe\ufffdWVi'\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\u03f1\ufffd\u03e0\ufffd>\ufffd\ufffd\ufffdzYoY\ufffdV\ufffd\ufffdv\ufffd\ufffd|Qd\ufffd\ufffd$0Gq\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "15583 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "15583"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
13432
|
—
|
Sonde port
Sonde port · port 13432 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13432
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 13432,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "18368c14c62e75517d8c192ae7625702fbc549ba",
"event_fingerprint": "19353f13d30fae09b94469740beb0f8e59e0ec0c",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 13432,
"risk_score": 33
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f86fc08ceaac5ad6371a8f95b3a380796e594e85",
"protocol_details": {
"port": 13432
},
"attack_vector": "Sonde port \u00b7 port 13432 \u00b7 (sonde \/ probe)",
"target_port_label": "13432",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 13432,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 13432
},
"attack_vector": "Sonde port \u00b7 port 13432 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "13432",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:13432",
"port:13902"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
13902
|
—
|
Sonde port
Sonde port · port 13902 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13902
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 13902,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "600e6de021f77d5d2656d326462dc89463937f9f",
"event_fingerprint": "cbbf1b83c7ffcb17ed2fa925eb53d2442bd6c0fe",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 13902,
"risk_score": 44
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4c32483ab50ee2111ae44b49fdb8c395bf2ab39",
"protocol_details": {
"payload_preview": "00000000",
"port": 13902
},
"evidence_snippet": "00000000",
"attack_vector": "Sonde port \u00b7 port 13902 \u00b7 (sonde \/ probe)",
"target_port_label": "13902",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13902,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "00000000",
"port": 13902
},
"attack_vector": "Sonde port \u00b7 port 13902 \u00b7 (sonde \/ probe)",
"evidence_snippet": "00000000",
"target_port_label": "13902",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13902"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
16939 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:16939 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
16939
Chemin / cible
—
Service
TLS
Payload
� ��x�C5O[c��� ��� qE��H� �|$�/ t����5�x�Q=��^#�C��hc���$?�A�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
67%
Corrélation +18
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��x�C5O[c��� ��� qE��H� �|$�/ t����5�x�Q=��^#�C��hc���$?�A�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��x�C5O[c��� ��� qE��H� �|$�/ t����5�x�Q=��^#�C��hc���$?�A�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �&��$�lW��̚MI �4YC�BK,L\�HT
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.83535737876471,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 16939,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d685ce8f8adc5917b1ca44e6c830d089aad64b48",
"event_fingerprint": "789a85437753f5ce51f3563d054a0cf3eaf1c554",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "8555429d3c3f1bd5cd4398feded01b5c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 16939,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005x\ufffdC\u00105O[c\ufffd\ufffd\u0014\ufffd\u001e\ufffd\ufffd\ufffd\f\u0007qE\ufffd\ufffdH\ufffd\f\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\b\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005x\ufffdC\u00105O[c\ufffd\ufffd\u0014\ufffd\u001e\ufffd\ufffd\ufffd\f\u0007qE\ufffd\ufffdH\ufffd\f\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\b\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd&\ufffd\u0013\ufffd$\ufffdlW\ufffd\ufffd\u0004\u031aMI\t\u001a\ufffd4YC\ufffdBK,L\\\ufffdH\u000eT",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005x\ufffdC\u00105O[c\ufffd\ufffd\u0014\ufffd\u001e\ufffd\ufffd\ufffd\f\u0007qE\ufffd\ufffdH\ufffd\f\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\b\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9485673d3b528d4a6a3ed8dfceb7e735d21e88ca",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005x\ufffdC\u00105O[c\ufffd\ufffd\u0014\ufffd\u001e\ufffd\ufffd\ufffd\f\u0007qE\ufffd\ufffdH\ufffd\f\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\b\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 16939,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdx\ufffdC5O[c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdqE\ufffd\ufffdH\ufffd\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:16939 \u00b7 (sonde \/ probe)",
"target_port_label": "16939 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 16939,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005x\ufffdC\u00105O[c\ufffd\ufffd\u0014\ufffd\u001e\ufffd\ufffd\ufffd\f\u0007qE\ufffd\ufffdH\ufffd\f\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\b\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 16939,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:16939 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdx\ufffdC5O[c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdqE\ufffd\ufffdH\ufffd\ufffd|$\ufffd\/ t\ufffd\ufffd\ufffd\ufffd5\ufffdx\ufffdQ=\ufffd\ufffd^#\ufffdC\ufffd\ufffdhc\ufffd\ufffd\ufffd$?\ufffdA\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "16939 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "16939"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"port:13432",
"port:13445",
"port:14073",
"tls"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 21,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
14073
|
—
|
Scan de ports
port scan syn · port 14073 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14073
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 14073,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5b1a6a9213fc7e20c2b97711910b59d52e6218d4",
"event_fingerprint": "cca6ad51e1779b737bd258a70649b2f5b62c7177",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 14073,
"risk_score": 42
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b55f04188628c055b5235f1628bbf4a03713f7c4",
"protocol_details": {
"payload_preview": "00000000",
"port": 14073
},
"evidence_snippet": "00000000",
"attack_vector": "port scan syn \u00b7 port 14073 \u00b7 (reconnaissance)",
"target_port_label": "14073",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 14073,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "00000000",
"port": 14073
},
"attack_vector": "port scan syn \u00b7 port 14073 \u00b7 (reconnaissance)",
"evidence_snippet": "00000000",
"target_port_label": "14073",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "14073"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"port:13432",
"port:13445",
"port:14073"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
13445
|
—
|
Sonde port
Sonde port · port 13445 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13445
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 13445,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1dae452f44a1b47976e1f38ff60fae84cef59d34",
"event_fingerprint": "1b223da2f015c158d0938b9064681889a7a26ec3",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 13445,
"risk_score": 33
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14e91db0000764a093a28fae2b3568d77e477560",
"protocol_details": {
"payload_preview": "00000000",
"port": 13445
},
"evidence_snippet": "00000000",
"attack_vector": "Sonde port \u00b7 port 13445 \u00b7 (sonde \/ probe)",
"target_port_label": "13445",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 13445,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "00000000",
"port": 13445
},
"attack_vector": "Sonde port \u00b7 port 13445 \u00b7 (sonde \/ probe)",
"evidence_snippet": "00000000",
"target_port_label": "13445",
"emulator_service": null,
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13445"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:13432",
"port:13445"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
13432
|
—
|
Sonde port
Sonde port · port 13432 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13432
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
00000000
Meta JSON brut
{
"bytes_in": 8,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 13432,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "18368c14c62e75517d8c192ae7625702fbc549ba",
"event_fingerprint": "19353f13d30fae09b94469740beb0f8e59e0ec0c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e071fd9b023ed8f18458a73613a0834",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 13432,
"risk_score": 44
},
"payload_preview": "00000000",
"request_sample": "00000000",
"payload_snippet": "00000000",
"evidence": {
"request_sample": "00000000",
"payload_snippet": "00000000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ef0f432fdc79d64982b77565495a594e80e9a66",
"protocol_details": {
"payload_preview": "00000000",
"port": 13432
},
"evidence_snippet": "00000000",
"attack_vector": "Sonde port \u00b7 port 13432 \u00b7 (sonde \/ probe)",
"target_port_label": "13432",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 13432,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "00000000",
"port": 13432
},
"attack_vector": "Sonde port \u00b7 port 13432 \u00b7 (sonde \/ probe)",
"evidence_snippet": "00000000",
"target_port_label": "13432",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "13432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
17245
|
—
|
Sonde port
Sonde port · port 17245 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17245
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Modat B.V.",
"service": null,
"app_proto": null,
"asn": 209334,
"country": "CA",
"dst_port": 17245,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "af93829e2674221a38a14f1ef10226e51646e98b",
"event_fingerprint": "e2c62dd49bf13f709e39b26ffca07a01f68a7ed4",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 17245,
"risk_score": 44
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a59d77991903a9e7752d1b38242a88a6b2f8136a",
"protocol_details": {
"port": 17245
},
"attack_vector": "Sonde port \u00b7 port 17245 \u00b7 (sonde \/ probe)",
"target_port_label": "17245",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 17245,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 17245
},
"attack_vector": "Sonde port \u00b7 port 17245 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "17245",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17245"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"port:17245",
"tls"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 22,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
13951 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:13951 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13951
Chemin / cible
—
Service
TLS
Payload
� ��i9S�T�iwkX��q�@��&-%.�����Y ��Z�(�Wu4�6X ��m����c\@�*�? &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��i9S�T�iwkX��q�@��&-%.�����Y ��Z�(�Wu4�6X ��m����c\@�*�? &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��i9S�T�iwkX��q�@��&-%.�����Y ��Z�(�Wu4�6X ��m����c\@�*�? &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �� �~����&E����B2�g�VE�V< �}
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.85167016430281,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 13951,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "29cba716e76727f548aecddc9a3c12872f541828",
"event_fingerprint": "939b9414f01e298febf7f8d148e624f67861842d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "cfd9f8f3c2b567ac16bac26f455291b5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 13951,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdi9S\ufffdT\ufffdiwkX\u000e\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\u001b\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\u001b\ufffdWu4\ufffd6X\u001a\u001c\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\\u001b@\ufffd\u001b*\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdi9S\ufffdT\ufffdiwkX\u000e\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\u001b\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\u001b\ufffdWu4\ufffd6X\u001a\u001c\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\\u001b@\ufffd\u001b*\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\t\ufffd~\ufffd\ufffd\ufffd\ufffd&E\ufffd\ufffd\ufffd\u0015\ufffdB\u000e2\ufffdg\u0010\ufffdVE\ufffdV<\n\u0001\ufffd}",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdi9S\ufffdT\ufffdiwkX\u000e\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\u001b\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\u001b\ufffdWu4\ufffd6X\u001a\u001c\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\\u001b@\ufffd\u001b*\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "374a608f0ab8053d1a1284e8064289c5e8467ad0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdi9S\ufffdT\ufffdiwkX\u000e\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\u001b\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\u001b\ufffdWu4\ufffd6X\u001a\u001c\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\\u001b@\ufffd\u001b*\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13951,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdi9S\ufffdT\ufffdiwkX\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\ufffdWu4\ufffd6X\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\@\ufffd*\ufffd?&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:13951 \u00b7 (sonde \/ probe)",
"target_port_label": "13951 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 13951,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdi9S\ufffdT\ufffdiwkX\u000e\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\u001b\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\u001b\ufffdWu4\ufffd6X\u001a\u001c\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\\u001b@\ufffd\u001b*\ufffd?\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13951,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:13951 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdi9S\ufffdT\ufffdiwkX\ufffd\ufffdq\ufffd@\ufffd\ufffd&-%.\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\ufffdZ\ufffd(\ufffdWu4\ufffd6X\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdc\\@\ufffd*\ufffd?&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "13951 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "13951"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|