|
|
TCP |
20793 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:20793 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20793
Chemin / cible
—
Service
TLS
Payload
� ���� ��7� N��D� ��몘 l�>_40�b o��Λ�z�n �b3bG6 Ѱ����e|1} &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���� ��7� N��D� ��몘
l�>_40�b o��Λ�z�n �b3bG6 Ѱ����e|1} &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���� ��7� N��D� ��몘 l�>_40�b o��Λ�z�n �b3bG6 Ѱ����e|1} &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �"� {o$7�L�o���t�v�po"6~��<���
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.790353651461878,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 20793,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5e1187b258ef87596d9d9f4fa9e0f1adf811b2bd",
"event_fingerprint": "52e6827a569b3bc02b73d8a543f77884081b8160",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "6440542b3fce47d624ddc82ec8358cb7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 20793,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u00067\ufffd\tN\ufffd\ufffdD\u0005\ufffd\u001c\ufffd\ufffd\uba98\nl\u0016\ufffd>_40\ufffdb \u0015o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\u0018\ufffdb3bG6\u000b\f\u0470\ufffd\u0006\ufffd\ufffd\ufffde\u0019|1}\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u00067\ufffd\tN\ufffd\ufffdD\u0005\ufffd\u001c\ufffd\ufffd\uba98\nl\u0016\ufffd>_40\ufffdb \u0015o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\u0018\ufffdb3bG6\u000b\f\u0470\ufffd\u0006\ufffd\ufffd\ufffde\u0019|1}\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\"\ufffd\u0000{o$7\ufffdL\ufffdo\ufffd\ufffd\ufffdt\ufffdv\ufffdpo\"6\u001a~\ufffd\ufffd<\ufffd\ufffd\ufffd\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u00067\ufffd\tN\ufffd\ufffdD\u0005\ufffd\u001c\ufffd\ufffd\uba98\nl\u0016\ufffd>_40\ufffdb \u0015o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\u0018\ufffdb3bG6\u000b\f\u0470\ufffd\u0006\ufffd\ufffd\ufffde\u0019|1}\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e26ee1c1a5699871a4e08412fa8da2009a9095f1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u00067\ufffd\tN\ufffd\ufffdD\u0005\ufffd\u001c\ufffd\ufffd\uba98\nl\u0016\ufffd>_40\ufffdb \u0015o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\u0018\ufffdb3bG6\u000b\f\u0470\ufffd\u0006\ufffd\ufffd\ufffde\u0019|1}\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 20793,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\tN\ufffd\ufffdD\ufffd\ufffd\ufffd\uba98\nl\ufffd>_40\ufffdb o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\ufffdb3bG6\u0470\ufffd\ufffd\ufffd\ufffde|1}&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:20793 \u00b7 (sonde \/ probe)",
"target_port_label": "20793 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 20793,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u00067\ufffd\tN\ufffd\ufffdD\u0005\ufffd\u001c\ufffd\ufffd\uba98\nl\u0016\ufffd>_40\ufffdb \u0015o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\u0018\ufffdb3bG6\u000b\f\u0470\ufffd\u0006\ufffd\ufffd\ufffde\u0019|1}\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 20793,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:20793 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\tN\ufffd\ufffdD\ufffd\ufffd\ufffd\uba98\nl\ufffd>_40\ufffdb o\ufffd\ufffd\u039b\ufffdz\ufffdn\t\ufffdb3bG6\u0470\ufffd\ufffd\ufffd\ufffde|1}&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "20793 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "20793"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18199 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:18199 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18199
Chemin / cible
—
Service
TLS
Payload
� ��. ��9I� �����'Q�ӳ���p����Vf NnN$�y$��Bs7��}i �`&�BT���p�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��. ��9I�
�����'Q�ӳ���p����Vf NnN$�y$��Bs7��}i �`&�BT���p�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��. ��9I� �����'Q�ӳ���p����Vf NnN$�y$��Bs7��}i �`&�BT���p�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �^:ty)�� W�Y���+��&̵�~%H�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.834451542346056,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18199,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6896e8dd5017ce44a80f79fe5ef35d84141f1b8",
"event_fingerprint": "1f11f7c11f1b733e0468ecc7c3606fd86afe207c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "565b2728b2e542d291eaf9a7b6516b72",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18199,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd.\u001d\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\u0014\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\u0013\ufffd\ufffd\ufffd\ufffdVf \u0017NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\u001f\u0004\ufffd`&\ufffd\u0014BT\ufffd\ufffd\ufffdp\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd.\u001d\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\u0014\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\u0013\ufffd\ufffd\ufffd\ufffdVf \u0017NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\u001f\u0004\ufffd`&\ufffd\u0014BT\ufffd\ufffd\ufffdp\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd^:ty)\ufffd\u0013\ufffd\u001e\u0000W\u000f\ufffdY\ufffd\u0002\ufffd\ufffd\u0011+\ufffd\ufffd&\u0335\ufffd~%H\ufffd\u0019",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd.\u001d\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\u0014\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\u0013\ufffd\ufffd\ufffd\ufffdVf \u0017NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\u001f\u0004\ufffd`&\ufffd\u0014BT\ufffd\ufffd\ufffdp\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d38ada3bd8f36a9ff9d04bc7408979b25a47a1a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd.\u001d\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\u0014\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\u0013\ufffd\ufffd\ufffd\ufffdVf \u0017NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\u001f\u0004\ufffd`&\ufffd\u0014BT\ufffd\ufffd\ufffdp\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18199,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd.\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdVf NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\ufffd`&\ufffdBT\ufffd\ufffd\ufffdp\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:18199 \u00b7 (sonde \/ probe)",
"target_port_label": "18199 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18199,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd.\u001d\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\u0014\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\u0013\ufffd\ufffd\ufffd\ufffdVf \u0017NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\u001f\u0004\ufffd`&\ufffd\u0014BT\ufffd\ufffd\ufffdp\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18199,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:18199 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd.\ufffd\ufffd9I\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd'Q\ufffd\u04f3\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdVf NnN$\ufffdy$\ufffd\ufffdBs7\ufffd\ufffd}i\ufffd`&\ufffdBT\ufffd\ufffd\ufffdp\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18199 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18199"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
14572 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:14572 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14572
Chemin / cible
—
Service
TLS
Payload
� �9� �4�f�R�>.�'�]�>�:�Z{dg�w(_J cB2K�B���5�gqr���?��=T� ��~7 &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9� �4�f�R�>.�'�]�>�:�Z{dg�w(_J cB2K�B���5�gqr���?��=T� ��~7 &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �9� �4�f�R�>.�'�]�>�:�Z{dg�w(_J cB2K�B���5�gqr���?��=T� ��~7 &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ���y��7 a�IB~�9��Q���]��4'
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.826567837265319,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 14572,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4eadf7a661fe2aeadc8468a645ad35670e1b4a5d",
"event_fingerprint": "23864df8d25bc05027da17e63543b10f8320c2d7",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "4028ca2fd07c2955fd601d4fe6ed424a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 14572,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\u000e\ufffd>\ufffd\u0001:\ufffdZ{dg\ufffdw(_J cB2K\ufffd\u0018B\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd\u0006=T\ufffd\u001c\u001a\ufffd\ufffd~\u00167\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\u000e\ufffd>\ufffd\u0001:\ufffdZ{dg\ufffdw(_J cB2K\ufffd\u0018B\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd\u0006=T\ufffd\u001c\u001a\ufffd\ufffd~\u00167\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdy\u0015\u0011\ufffd\ufffd7\ta\ufffdIB~\ufffd9\ufffd\ufffdQ\ufffd\ufffd\ufffd]\ufffd\ufffd4'",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\u000e\ufffd>\ufffd\u0001:\ufffdZ{dg\ufffdw(_J cB2K\ufffd\u0018B\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd\u0006=T\ufffd\u001c\u001a\ufffd\ufffd~\u00167\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa36d504bbec46701c339ef44bf380d0f579adf7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\u000e\ufffd>\ufffd\u0001:\ufffdZ{dg\ufffdw(_J cB2K\ufffd\u0018B\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd\u0006=T\ufffd\u001c\u001a\ufffd\ufffd~\u00167\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 14572,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd9\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\ufffd>\ufffd:\ufffdZ{dg\ufffdw(_J cB2K\ufffdB\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd=T\ufffd\ufffd\ufffd~7&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:14572 \u00b7 (sonde \/ probe)",
"target_port_label": "14572 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 14572,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\u000e\ufffd>\ufffd\u0001:\ufffdZ{dg\ufffdw(_J cB2K\ufffd\u0018B\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd\u0006=T\ufffd\u001c\u001a\ufffd\ufffd~\u00167\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 14572,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:14572 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd9\ufffd \ufffd4\ufffdf\ufffdR\ufffd>.\ufffd'\ufffd]\ufffd>\ufffd:\ufffdZ{dg\ufffdw(_J cB2K\ufffdB\ufffd\ufffd\ufffd5\ufffdgqr\ufffd\ufffd\ufffd?\ufffd\ufffd=T\ufffd\ufffd\ufffd~7&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "14572 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "14572"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
14530 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:14530 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
14530
Chemin / cible
—
Service
TLS
Payload
� ��Pp.�s�5 OEh���A�t� $ܰ{�� �Qf �{ζB��FSkǚj^jd��xk�KY(�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Pp.�s�5 OEh���A�t� $ܰ{�� �Qf �{ζB��FSkǚj^jd��xk�KY(�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��Pp.�s�5 OEh���A�t� $ܰ{�� �Qf �{ζB��FSkǚj^jd��xk�KY(�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ yݴB�\�nіA6�o�vF�2�ܗH�.���}�G
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.88171056891134,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 14530,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "15aa36d65d5e1ed0480ad1bddeaa54307a123a24",
"event_fingerprint": "f501bd444add1e9e6b72a37e1dc38e007e227314",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "32c6b700658c07d87c6f1b6e4785851c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 14530,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdPp\u0005\u0002.\ufffd\u001as\ufffd5\u001f\u0000O\u0015Eh\ufffd\ufffd\ufffdA\u0004\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\u000b\ufffd{\u03b6B\ufffd\ufffdF\u001bSk\u01da\u0006j^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdPp\u0005\u0002.\ufffd\u001as\ufffd5\u001f\u0000O\u0015Eh\ufffd\ufffd\ufffdA\u0004\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\u000b\ufffd{\u03b6B\ufffd\ufffdF\u001bSk\u01da\u0006j^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 y\u0774B\u0011\ufffd\\\ufffdn\u0456A6\ufffdo\ufffdvF\ufffd2\ufffd\u0717H\ufffd.\ufffd\ufffd\ufffd}\ufffdG",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdPp\u0005\u0002.\ufffd\u001as\ufffd5\u001f\u0000O\u0015Eh\ufffd\ufffd\ufffdA\u0004\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\u000b\ufffd{\u03b6B\ufffd\ufffdF\u001bSk\u01da\u0006j^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3fb0a3cd0f8477022770d2d328fe3e03f67d6ef",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdPp\u0005\u0002.\ufffd\u001as\ufffd5\u001f\u0000O\u0015Eh\ufffd\ufffd\ufffdA\u0004\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\u000b\ufffd{\u03b6B\ufffd\ufffdF\u001bSk\u01da\u0006j^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 14530,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdPp.\ufffds\ufffd5OEh\ufffd\ufffd\ufffdA\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\ufffd{\u03b6B\ufffd\ufffdFSk\u01daj^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:14530 \u00b7 (sonde \/ probe)",
"target_port_label": "14530 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 14530,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdPp\u0005\u0002.\ufffd\u001as\ufffd5\u001f\u0000O\u0015Eh\ufffd\ufffd\ufffdA\u0004\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\u000b\ufffd{\u03b6B\ufffd\ufffdF\u001bSk\u01da\u0006j^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 14530,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:14530 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdPp.\ufffds\ufffd5OEh\ufffd\ufffd\ufffdA\ufffdt\ufffd\t$\u0730{\ufffd\ufffd \ufffdQf\ufffd{\u03b6B\ufffd\ufffdFSk\u01daj^jd\ufffd\ufffdxk\ufffdKY(\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "14530 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "14530"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
13402 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:13402 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13402
Chemin / cible
—
Service
TLS
Payload
� ��ޣ5`��%6� BA�nj�<�Ɩ�l� � (;wt�!ޑ��V��$�>M��>&n��Lm�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ޣ5`��%6�
BA�nj�<�Ɩ�l� �
(;wt�!ޑ��V��$�>M��>&n��Lm�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��ޣ5`��%6� BA�nj�<�Ɩ�l� � (;wt�!ޑ��V��$�>M��>&n��Lm�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ˗_[?c���|��k���RXu�c��G�E`
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.856942203858687,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 13402,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c6a41362fccb8ece70e5cea3ff9aa570931a3c02",
"event_fingerprint": "00d1001eb25eee034c1f4e47a9ce94d674f26666",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "5e359f681c2dad0484cd7338a874fe41",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 13402,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0010\u07a35`\ufffd\ufffd\u0004%6\ufffd\u0010\n\u001fBA\u000f\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\u0019\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0010\u07a35`\ufffd\ufffd\u0004%6\ufffd\u0010\n\u001fBA\u000f\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\u0019\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u02d7_\u0005\u0013[?c\ufffd\ufffd\ufffd\b|\u0012\ufffd\ufffdk\ufffd\ufffd\ufffdRXu\ufffdc\ufffd\ufffdG\u0019\ufffdE`",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0010\u07a35`\ufffd\ufffd\u0004%6\ufffd\u0010\n\u001fBA\u000f\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\u0019\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "521617a38a54779ee4a71eec0062afb6da837f06",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0010\u07a35`\ufffd\ufffd\u0004%6\ufffd\u0010\n\u001fBA\u000f\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\u0019\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13402,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u07a35`\ufffd\ufffd%6\ufffd\nBA\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:13402 \u00b7 (sonde \/ probe)",
"target_port_label": "13402 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 13402,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0010\u07a35`\ufffd\ufffd\u0004%6\ufffd\u0010\n\u001fBA\u000f\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\u0019\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13402,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:13402 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u07a35`\ufffd\ufffd%6\ufffd\nBA\ufffdnj\ufffd<\ufffd\u0196\ufffdl\ufffd \ufffd \n(;wt\ufffd!\u0791\ufffd\ufffdV\ufffd\u05fe\ufffd$\ufffd>M\ufffd\ufffd>&n\ufffd\ufffdLm\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "13402 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "13402"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
29756 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:29756 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29756
Chemin / cible
—
Service
TLS
Payload
� �h�3KɝY��.�b~���50x���3dl�E�K� x.�A�q�U )p�������\ ]�M�Ǯ� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �h�3KɝY��.�b~���50x���3dl�E�K� x.�A�q�U
)p�������\ ]�M�Ǯ� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �h�3KɝY��.�b~���50x���3dl�E�K� x.�A�q�U )p�������\ ]�M�Ǯ� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ )��zCaE1}&�_=�CU Wc�G�Wh�[
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.7560112651347595,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 29756,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "44f670144eafc505b80f132b5ebc6395978d5ca0",
"event_fingerprint": "f04de0eaefde5ee0d1c080230c1542115cf9c1a8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "bd063be7817e8a0fd1563dd53f002664",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 29756,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\u001b\ufffd3K\u025dY\ufffd\ufffd.\ufffdb\u0007~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\u0011\ufffdA\ufffdq\ufffdU\u0007\r\u001d)p\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u0003\u01ee\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\u001b\ufffd3K\u025dY\ufffd\ufffd.\ufffdb\u0007~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\u0011\ufffdA\ufffdq\ufffdU\u0007\r\u001d)p\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u0003\u01ee\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 )\ufffd\ufffdzCaE\u000f\u00191}&\u0014\ufffd_=\ufffdCU\tWc\ufffd\u0014G\ufffdWh\ufffd[\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\u001b\ufffd3K\u025dY\ufffd\ufffd.\ufffdb\u0007~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\u0011\ufffdA\ufffdq\ufffdU\u0007\r\u001d)p\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u0003\u01ee\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b113b93c2011346cb07768fe0c50c96c8c2159f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\u001b\ufffd3K\u025dY\ufffd\ufffd.\ufffdb\u0007~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\u0011\ufffdA\ufffdq\ufffdU\u0007\r\u001d)p\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u0003\u01ee\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29756,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdh\ufffd3K\u025dY\ufffd\ufffd.\ufffdb~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\ufffdA\ufffdq\ufffdU\r)p\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u01ee\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:29756 \u00b7 (reconnaissance)",
"target_port_label": "29756 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 29756,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\u001b\ufffd3K\u025dY\ufffd\ufffd.\ufffdb\u0007~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\u0011\ufffdA\ufffdq\ufffdU\u0007\r\u001d)p\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u0003\u01ee\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29756,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:29756 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdh\ufffd3K\u025dY\ufffd\ufffd.\ufffdb~\ufffd\ufffd\ufffd50x\ufffd\ufffd\ufffd3dl\ufffdE\ufffdK\ufffd x.\ufffdA\ufffdq\ufffdU\r)p\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\t]\ufffdM\ufffd\u01ee\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "29756 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "29756"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
29352,
29462,
29554,
29756,
29773
],
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
29462 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:29462 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29462
Chemin / cible
—
Service
TLS
Payload
� �\�C���)�T���P&W�̯� ~]��Y6 ��ʡ�@$O?݊Y�c;!�F��1���8L��z� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �\�C���)�T���P&W�̯� ~]��Y6 ��ʡ�@$O?݊Y�c;!�F��1���8L��z� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �\�C���)�T���P&W�̯� ~]��Y6 ��ʡ�@$O?݊Y�c;!�F��1���8L��z� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �$�h�XH.M��k�8)��o���a�|s6
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.853782561759506,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 29462,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5862aef451d392893d493eebed81eefa03fabf8c",
"event_fingerprint": "229c01a6c602ca81037173df76f4e404d107e092",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "cdbeca148e220fa16a4c89acc1289fd5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 29462,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\u000e\ufffd\u032f\ufffd\u000b~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\u000f\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\u000e\ufffd\u032f\ufffd\u000b~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\u000f\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd$\ufffdh\ufffdXH.M\ufffd\ufffdk\ufffd8)\ufffd\b\ufffd\u001bo\u0001\ufffd\ufffd\ufffd\u0014a\ufffd|s6",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\u000e\ufffd\u032f\ufffd\u000b~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\u000f\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7d6eb365699b23cce65a06e17d029b0a75c1e823",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\u000e\ufffd\u032f\ufffd\u000b~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\u000f\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29462,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\ufffd\u032f\ufffd~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:29462 \u00b7 (reconnaissance)",
"target_port_label": "29462 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 29462,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\u000e\ufffd\u032f\ufffd\u000b~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\u000f\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29462,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:29462 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\\\ufffdC\ufffd\ufffd\ufffd)\ufffdT\ufffd\ufffd\ud944\udd36\ufffdP&W\ufffd\u032f\ufffd~]\ufffd\ufffdY6 \ufffd\ufffd\u02a1\ufffd@$O?\u074aY\ufffdc;!\ufffdF\ufffd\ufffd1\ufffd\ufffd\ufffd8L\ufffd\ufffdz\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "29462 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "29462"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 1.64,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
29554 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:29554 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29554
Chemin / cible
—
Service
TLS
Payload
� ����ޱv�T����s ߋ�+��`��Q�k�?/ @�\]��ڢWd�!t���;���+���X��� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +20
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����ޱv�T����s
ߋ�+��`��Q�k�?/ @�\]��ڢWd�!t���;���+���X��� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ����ޱv�T����s ߋ�+��`��Q�k�?/ @�\]��ڢWd�!t���;���+���X��� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��]:�/��Qec�"�K�s�2����p߶fIb
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.808131362243124,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 29554,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "adce5f3243a65dca8651025b876a2262eca45b3f",
"event_fingerprint": "c4190bdfc7057c1054ffda6c831f8aad34360fc6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "f8424554e50ac9b83ff3fb3219c99ad6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 29554,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07b1v\ufffdT\u0007\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd\u0011+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd\u0016?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\u0002\ufffd\ufffd\u0017\ufffd;\ufffd\b\ufffd\ufffd+\ufffd\u0006\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07b1v\ufffdT\u0007\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd\u0011+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd\u0016?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\u0002\ufffd\ufffd\u0017\ufffd;\ufffd\b\ufffd\ufffd+\ufffd\u0006\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0018]\u0019:\ufffd\/\ufffd\ufffdQec\ufffd\"\ufffdK\ufffds\u001a\ufffd2\ufffd\ufffd\ufffd\ufffdp\u07f6fIb",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07b1v\ufffdT\u0007\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd\u0011+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd\u0016?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\u0002\ufffd\ufffd\u0017\ufffd;\ufffd\b\ufffd\ufffd+\ufffd\u0006\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d5a0ab8b2425ca4ff7b102921b4ff5aa29e69e4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07b1v\ufffdT\u0007\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd\u0011+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd\u0016?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\u0002\ufffd\ufffd\u0017\ufffd;\ufffd\b\ufffd\ufffd+\ufffd\u0006\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29554,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u07b1v\ufffdT\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:29554 \u00b7 (reconnaissance)",
"target_port_label": "29554 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 20
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 29554,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u07b1v\ufffdT\u0007\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd\u0011+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd\u0016?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\u0002\ufffd\ufffd\u0017\ufffd;\ufffd\b\ufffd\ufffd+\ufffd\u0006\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29554,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:29554 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u07b1v\ufffdT\ufffd\ufffd\ufffd\ufffds\n\u07cb\ufffd+\ufffd\ufffd`\ufffd\ufffdQ\ufffdk\ufffd?\/ @\ufffd\\]\ufffd\ufffd\u06a2Wd\ufffd!t\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "29554 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "29554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
29352,
29462,
29554,
29773
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 2.12,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan"
],
"correlation_confidence_boost": 20,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
29773 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:29773 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29773
Chemin / cible
—
Service
TLS
Payload
� � K79��Cjy��E!�hY�e�M �@8z��� 2A�4)�(���^s5�ź3,�n�WtX ��� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �
K79��Cjy��E!�hY�e�M �@8z��� 2A�4)�(���^s5�ź3,�n�WtX ��� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� � K79��Cjy��E!�hY�e�M �@8z��� 2A�4)�(���^s5�ź3,�n�WtX ��� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ &LI�Ɔ������q ѩ�K.�~��� �'5
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.875683345223052,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 29773,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a647752980e1ad47530cb92202699657cd33916b",
"event_fingerprint": "f9af907d1645cc5457be6f0282427dcfa223ab77",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "4b55557d9de01b5097242917dc12e438",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 29773,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffd\u0012hY\ufffde\ufffdM\u001c \u0002\u0001\ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\u0016\ufffd\ufffd\u0014^s5\ufffd\u017a3,\ufffdn\ufffdWt\u001bX\u001c\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffd\u0012hY\ufffde\ufffdM\u001c \u0002\u0001\ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\u0016\ufffd\ufffd\u0014^s5\ufffd\u017a3,\ufffdn\ufffdWt\u001bX\u001c\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 &LI\ufffd\u0186\ufffd\u05fd\ufffd\ufffd\ufffd\ufffd\ufffdq\u001d\u0469\ufffdK.\ufffd~\ufffd\ufffd\ufffd\u000b\ufffd'5",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffd\u0012hY\ufffde\ufffdM\u001c \u0002\u0001\ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\u0016\ufffd\ufffd\u0014^s5\ufffd\u017a3,\ufffdn\ufffdWt\u001bX\u001c\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59e9492a96dc525499419b91e2d77d1c3b3795e1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffd\u0012hY\ufffde\ufffdM\u001c \u0002\u0001\ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\u0016\ufffd\ufffd\u0014^s5\ufffd\u017a3,\ufffdn\ufffdWt\u001bX\u001c\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29773,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffdhY\ufffde\ufffdM \ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\ufffd\ufffd^s5\ufffd\u017a3,\ufffdn\ufffdWtX\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:29773 \u00b7 (sonde \/ probe)",
"target_port_label": "29773 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 29773,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffd\u0012hY\ufffde\ufffdM\u001c \u0002\u0001\ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\u0016\ufffd\ufffd\u0014^s5\ufffd\u017a3,\ufffdn\ufffdWt\u001bX\u001c\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29773,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:29773 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\nK79\ufffd\ufffdCjy\ufffd\ufffdE!\ufffdhY\ufffde\ufffdM \ufffd@8z\ufffd\ufffd\ufffd 2A\ufffd4)\ufffd(\ufffd\ufffd\ufffd^s5\ufffd\u017a3,\ufffdn\ufffdWtX\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "29773 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "29773"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
29352 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:29352 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
29352
Chemin / cible
—
Service
TLS
Payload
� ���ʜ}��M�R�WC�� �B��^2 )��� �~��fB2�C R�q� �e�n5 z�;9O� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���ʜ}��M�R�WC�� �B��^2 )��� �~��fB2�C R�q� �e�n5 z�;9O� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ���ʜ}��M�R�WC�� �B��^2 )��� �~��fB2�C R�q� �e�n5 z�;9O� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �ĺK�G0�<E�B�ǰPJ��۱��ZT �[
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.75686967143787,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 29352,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fe703ea7ead69838bd0aeffe91e01bcf0c4379b5",
"event_fingerprint": "515c832bad9b5977eccffe54ed02f2a7bf14fd61",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "abaa0663cea7a653bea8bee052903085",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 29352,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u029c\u0018}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\u0000\ufffdB\ufffd\ufffd^2\u0003\t)\ufffd\ufffd\ufffd\u0018\u0010 \ufffd~\ufffd\ufffd\u0012fB2\u0004\ufffdC\u001dR\ufffdq\ufffd\u0019\u000f\u001c\ufffde\ufffdn5\u001ez\ufffd;9O\ufffd\u0000\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u029c\u0018}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\u0000\ufffdB\ufffd\ufffd^2\u0003\t)\ufffd\ufffd\ufffd\u0018\u0010 \ufffd~\ufffd\ufffd\u0012fB2\u0004\ufffdC\u001dR\ufffdq\ufffd\u0019\u000f\u001c\ufffde\ufffdn5\u001ez\ufffd;9O\ufffd\u0000\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0007\ufffd\u013a\u000eK\ufffdG0\u0019\ufffd<E\ufffdB\ufffd\u01f0PJ\ufffd\ufffd\u06f1\ufffd\ufffdZT\r\ufffd[",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u029c\u0018}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\u0000\ufffdB\ufffd\ufffd^2\u0003\t)\ufffd\ufffd\ufffd\u0018\u0010 \ufffd~\ufffd\ufffd\u0012fB2\u0004\ufffdC\u001dR\ufffdq\ufffd\u0019\u000f\u001c\ufffde\ufffdn5\u001ez\ufffd;9O\ufffd\u0000\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2744b8ac4e59fb358b62e709929bb809e67518d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u029c\u0018}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\u0000\ufffdB\ufffd\ufffd^2\u0003\t)\ufffd\ufffd\ufffd\u0018\u0010 \ufffd~\ufffd\ufffd\u0012fB2\u0004\ufffdC\u001dR\ufffdq\ufffd\u0019\u000f\u001c\ufffde\ufffdn5\u001ez\ufffd;9O\ufffd\u0000\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29352,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u029c}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\ufffdB\ufffd\ufffd^2\t)\ufffd\ufffd\ufffd \ufffd~\ufffd\ufffdfB2\ufffdCR\ufffdq\ufffd\ufffde\ufffdn5z\ufffd;9O\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:29352 \u00b7 (sonde \/ probe)",
"target_port_label": "29352 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 29352,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u029c\u0018}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\u0000\ufffdB\ufffd\ufffd^2\u0003\t)\ufffd\ufffd\ufffd\u0018\u0010 \ufffd~\ufffd\ufffd\u0012fB2\u0004\ufffdC\u001dR\ufffdq\ufffd\u0019\u000f\u001c\ufffde\ufffdn5\u001ez\ufffd;9O\ufffd\u0000\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 29352,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:29352 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u029c}\ufffd\ufffdM\ufffdR\ufffdWC\ufffd\ufffd\ufffdB\ufffd\ufffd^2\t)\ufffd\ufffd\ufffd \ufffd~\ufffd\ufffdfB2\ufffdCR\ufffdq\ufffd\ufffde\ufffdn5z\ufffd;9O\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "29352 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "29352"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde port 22/TCP
port 22 tcp · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_ssh_probe
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Preuve honeypot — Sonde port 22/TCP
Connexion détectée sur le port 22 (TCP) du capteur simulé.
Service
SSH
Payload
GET / HTTP/1.1 Host: 62.3.50.33:22 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Ac
Pourquoi cette classification : Type « port_22_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 45
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:22
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Ac
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:22 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 151,
"payload_entropy": 5.142180465672533,
"port_category": "well_known",
"org": "Modat B.V.",
"service": "ssh",
"app_proto": "ssh",
"asn": 209334,
"country": "CA",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 46,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d7618832c0a2bdfa93a1dfe9da3c4b45bc1bbe62",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": true,
"named_candidate": "ssh_probe",
"service_name": "ssh",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2a183c8883a03b5ac03451c560f751c",
"path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"classification_reason": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93041023e71052b57af98896deba212332b2968f",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAc",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_ssh_probe",
"ssh_emulated"
]
}
|
|
|
TCP |
13636 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:13636 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13636
Chemin / cible
—
Service
TLS
Payload
� �+�� E�`�m�-[�""��p�<p���T�#*�6 ��[ȭ,# ۹[[w�L��3�_�d���{�E &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �+�� E�`�m�-[�""��p�<p���T�#*�6 ��[ȭ,# ۹[[w�L��3�_�d���{�E &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �+�� E�`�m�-[�""��p�<p���T�#*�6 ��[ȭ,# ۹[[w�L��3�_�d���{�E &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ 7.�O�I:� h �C��L���ک��4��}
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.853079627680171,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 13636,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7a922236a39d1633b0638e1ca6c60dcc709ecf0f",
"event_fingerprint": "1b50b2877908eeba63b529b230abaea912a6b4fa",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "ebeb89e3a411f0d09884a9cd43c95328",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 13636,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u000bE\ufffd\u0007`\ufffd\u001bm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\u000e\ufffd[\u022d,#\u001e\u06f9[[w\ufffdL\ufffd\u0013\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u000bE\ufffd\u0007`\ufffd\u001bm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\u000e\ufffd[\u022d,#\u001e\u06f9[[w\ufffdL\ufffd\u0013\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 7.\ufffdO\ufffd\u0006I:\u0018\ufffd\u001ch\u001d\ufffd\u0017C\ufffd\ufffdL\ufffd\ufffd\ufffd\u0014\u06a9\u0004\ufffd\ufffd4\ufffd\ufffd}",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u000bE\ufffd\u0007`\ufffd\u001bm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\u000e\ufffd[\u022d,#\u001e\u06f9[[w\ufffdL\ufffd\u0013\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "215b2acd9ac780c710bcc16b59e5c6c48e8c2b5a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u000bE\ufffd\u0007`\ufffd\u001bm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\u000e\ufffd[\u022d,#\u001e\u06f9[[w\ufffdL\ufffd\u0013\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13636,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffdE\ufffd`\ufffdm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\ufffd[\u022d,#\u06f9[[w\ufffdL\ufffd\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:13636 \u00b7 (sonde \/ probe)",
"target_port_label": "13636 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 13636,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u000bE\ufffd\u0007`\ufffd\u001bm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\u000e\ufffd[\u022d,#\u001e\u06f9[[w\ufffdL\ufffd\u0013\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 13636,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:13636 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffdE\ufffd`\ufffdm\ufffd-[\ufffd\"\"\ufffd\ufffdp\ufffd<p\ufffd\ufffd\ufffdT\ufffd#*\ufffd6 \ufffd\ufffd[\u022d,#\u06f9[[w\ufffdL\ufffd\ufffd3\ufffd_\ufffdd\ufffd\ufffd\ufffd{\ufffdE&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "13636 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "13636"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
3276 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3276 · (reconnaissance)
|
Élevée
|
Moyen · 50
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3276
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3276 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +29
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3276
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3276 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.17549329810746,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3276,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "ff842161e20a78f1d5b5a39a1b6fb8acc2238099",
"event_fingerprint": "444680213a2b6194c6c8576dc0e2f961e588dc8b",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 29
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e807958583a086e51758a2141d472883",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3276,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 50
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b485177b64f4521bdca22a871e0989eaa206a2be",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3276,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3276 \u00b7 (reconnaissance)",
"target_port_label": "3276 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 29
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3276,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +29",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3276,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3276 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3276\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3276 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +29",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3276"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
2377,
3203,
3213,
3215,
3218,
3225,
3252,
3276,
3280,
3288,
8333,
9025
],
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"bitcoin",
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"multi_category_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 29,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
3218 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3218 · (reconnaissance)
|
Élevée
|
Moyen · 51
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3218
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3218 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +33
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3218
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3218 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.167355307925522,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3218,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 51,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "52b43ddff5f7978131f27c6d9ea590da05a538d0",
"event_fingerprint": "64eadf1f1a255711ab32c217d23e0e225b8497ae",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 51,
"correlation_boost": 33
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ddebea7dea96753b4fb701455530b313",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3218,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "778530d47bd9763f2499106489b07845fcc8cefd",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3218,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3218 \u00b7 (reconnaissance)",
"target_port_label": "3218 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 51,
"correlation_boost": 33
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3218,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +33",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3218,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3218 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3218\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3218 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +33",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3218"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
2377,
3203,
3213,
3215,
3218,
3225,
3252,
3280,
3288,
8333,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.93,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"bitcoin",
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 33,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
3213 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3213 · (reconnaissance)
|
Élevée
|
Moyen · 50
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3213
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3213 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +33
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3213
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3213 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.143762886523975,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3213,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "7e9b49bf38934404c34c69e9e45a9d219f4690f7",
"event_fingerprint": "36d5b389e6e9c5d27b367eecb4f5019fef65481b",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 33
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f448807cf9cf5ef2dc55a50e879e1657",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3213,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 50
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8732019031d74f3b39389d28663e20ada50929b9",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3213,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3213 \u00b7 (reconnaissance)",
"target_port_label": "3213 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 33
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3213,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +33",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3213,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3213 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3213\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3213 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +33",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3213"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
2377,
3203,
3213,
3215,
3225,
3252,
3288,
8333,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 1.01,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"bitcoin",
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 33,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
3280 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3280 · (reconnaissance)
|
Élevée
|
Moyen · 51
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3280
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3280 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +33
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3280
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3280 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.170559392864561,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3280,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 51,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "0de87500331356b2deaaf5b7a233752aa09cd22e",
"event_fingerprint": "9d50811d161ae3b3ea701bf0fe408d1b09c3f037",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 51,
"correlation_boost": 33
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2ca05bbd7da0d038956f968514c98d7f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3280,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe1f9ec5d97db27143521dfa087b67648c0f9281",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3280,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3280 \u00b7 (reconnaissance)",
"target_port_label": "3280 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 51,
"correlation_boost": 33
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3280,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +33",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3280,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3280 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3280\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3280 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +33",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3280"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
2377,
3203,
3213,
3215,
3225,
3252,
3280,
3288,
8333,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.21,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"bitcoin",
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 33,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Scan de ports
port scan syn · via BITCOIN:8333 · (reconnaissance)
|
Élevée
|
Moyen · 50
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Investiguer
Tags
bitcoin_emulated
http_get_probe
mozi_pattern
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
GET / HTTP/1.1 Host: 62.3.50.33:8333 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +33
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8333
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8333 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 153,
"payload_entropy": 5.157487497439726,
"port_category": "registered",
"org": "Modat B.V.",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 209334,
"country": "CA",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 50,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2f949412779d32bcbcecee45ed85d32202fb8fcf",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 33
},
"named_classification_skipped": false,
"service_name": "bitcoin",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a783b6b858f8e18119cba01dcf383293",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 50
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6203c4f5cda6485fe360c7a2d335ec070dcc8d12",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via BITCOIN:8333 \u00b7 (reconnaissance)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via BITCOIN \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 33
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +33",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "port scan syn \u00b7 via BITCOIN:8333 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8333\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +33",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
2377,
3203,
3215,
3225,
3252,
3288,
8333,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.05,
"multi_category_scan": true,
"scan_category_diversity": [
"blockchain",
"cloud"
],
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"bitcoin",
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_category_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 33,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"bitcoin_emulated",
"http_get_probe",
"mozi_pattern",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
3288 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3288 · (reconnaissance)
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3288
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3288 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3288
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3288 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.17549329810746,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3288,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "d156a40068dd59f19f6a92f65fdbe9a5bdd57ed7",
"event_fingerprint": "6c9fb1c1dfa8afbfba80893702f666c56bb4b527",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "84f4a5dc56eb3f82dddf288fb9a83408",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3288,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f3b454a50b51fd351f9a85b3a0a512ff0245661",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3288,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3288 \u00b7 (reconnaissance)",
"target_port_label": "3288 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3288,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3288,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3288 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3288\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3288 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3288"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
2377,
3203,
3215,
3225,
3252,
3288,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.88,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
3225 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3225 · (reconnaissance)
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3225
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3225 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3225
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3225 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.149349507257787,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3225,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 47,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6d8cc4391677ece42935bbfc024cb70ec116eea7",
"event_fingerprint": "586cc6de4ec448746e9de8c152e87e93d64f0020",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "52e1827306f1fcaea423b9a4466cadea",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3225,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "357be850a8fba38c068f19f22248ec997834b921",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3225,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3225 \u00b7 (reconnaissance)",
"target_port_label": "3225 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3225,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3225,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3225 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3225\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3225 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3225"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
2377,
3203,
3215,
3225,
3252,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.81,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
3203 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3203 · (reconnaissance)
|
Élevée
|
Moyen · 49
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3203
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3203 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 49
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3203
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3203 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.146966971463015,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3203,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 49,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "80198b25f802d74beb6ae7aade2b1671cf99aed2",
"event_fingerprint": "ebddcb1b301f5b1284784578a64684f24c533b49",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 49,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ba92b35f11bccf06b1e8e1675268ab1",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3203,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 49
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08a2ab02661a42c610701f0ce6d265f8f4d7a5d2",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3203,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3203 \u00b7 (reconnaissance)",
"target_port_label": "3203 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 49,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3203,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3203,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3203 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3203\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3203 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
2377,
3203,
3215,
3252,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 0.98,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
2377 · DOCKER SWARM MGMT
|
docker-swarm-mgmt
|
Scan de ports
port scan syn · via DOCKER SWARM MGMT:2377 · (reconnaissance)
|
Élevée
|
Moyen · 50
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
DOCKER-SWARM-MGMT
WAF
—
Recommandation
Investiguer
Tags
docker_swarm_mgmt_emulated
docker_swarm_mgmt_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2377
Chemin / cible
—
Service
DOCKER SWARM MGMT
Payload
GET / HTTP/1.1 Host: 62.3.50.33:2377 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2377
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2377 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 153,
"payload_entropy": 5.17549329810746,
"port_category": "registered",
"org": "Modat B.V.",
"service": "docker-swarm-mgmt",
"app_proto": "docker-swarm-mgmt",
"asn": 209334,
"country": "CA",
"dst_port": 2377,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e48e06583ee3cc794728cdcf94ab8c4a9b650e7e",
"event_fingerprint": "28e8611f01e00a686a1c63b03b7f79b8e120c034",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "docker-swarm-mgmt",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3761ce9dff501ad06ed8ee3a95d33fdd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 2377,
"service": "docker-swarm-mgmt",
"service_name": "docker-swarm-mgmt",
"risk_score": 50
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94be9e72cccc3a2d9e08eaececfff051acfe5da4",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 2377,
"service": "docker-swarm-mgmt",
"service_label_fr": "DOCKER SWARM MGMT"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via DOCKER SWARM MGMT:2377 \u00b7 (reconnaissance)",
"target_port_label": "2377 \u00b7 DOCKER SWARM MGMT",
"emulator_service": "docker-swarm-mgmt",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via DOCKER SWARM MGMT \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "docker-swarm-mgmt",
"service_label_fr": "DOCKER SWARM MGMT",
"dst_port": 2377,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Docker Swarm 24.0",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 2377,
"service": "docker-swarm-mgmt",
"service_label_fr": "DOCKER SWARM MGMT"
},
"attack_vector": "port scan syn \u00b7 via DOCKER SWARM MGMT:2377 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "2377 \u00b7 DOCKER SWARM MGMT",
"emulator_service": "docker-swarm-mgmt",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "swarm",
"service_banner": "Docker Swarm 24.0",
"service_os": "linux",
"dst_port": "2377"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
2377,
3215,
3252,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 1.2,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"docker_swarm_mgmt_emulated",
"docker_swarm_mgmt_payload",
"http_get_probe",
"mozi_pattern",
"net_docker_api_probe"
]
}
|
|
|
TCP |
2377 · DOCKER SWARM MGMT
|
docker-swarm-mgmt
|
Scan de ports
port scan syn · via DOCKER SWARM MGMT:2377 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
JA3 35fa0a83e466acbe
Émulateur
DOCKER-SWARM-MGMT
WAF
—
Recommandation
Surveiller
Tags
docker_swarm_mgmt_emulated
docker_swarm_mgmt_payload
net_docker_api_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2377
Chemin / cible
—
Service
DOCKER SWARM MGMT
Payload
� ��_r��c��.Zb�8Tj������o�v��ύ/ �]$;, �o ]���Kpa�������uWq2@ &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��_r��c��.Zb�8Tj������o�v��ύ/ �]$;, �o
]���Kpa�������uWq2@ &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��_r��c��.Zb�8Tj������o�v��ύ/ �]$;, �o ]���Kpa�������uWq2@ &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ � m�w��l��1��<�h�z<e��: ��^�x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 243,
"payload_entropy": 5.92015615611774,
"port_category": "registered",
"org": "Modat B.V.",
"service": "docker-swarm-mgmt",
"app_proto": "docker-swarm-mgmt",
"asn": 209334,
"country": "CA",
"dst_port": 2377,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b4de08741fdbab4900861d0d56031ee96ba44b37",
"event_fingerprint": "28e8611f01e00a686a1c63b03b7f79b8e120c034",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "docker-swarm-mgmt",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e0d021cddaab9d62939e0af7d8406e8f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2377,
"service": "docker-swarm-mgmt",
"service_name": "docker-swarm-mgmt",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_r\ufffd\ufffdc\ufffd\ufffd.\u0012Zb\ufffd8Tj\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0005\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\f\ufffdo\n]\ufffd\ufffd\ufffd\u0007Kpa\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_r\ufffd\ufffdc\ufffd\ufffd.\u0012Zb\ufffd8Tj\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0005\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\f\ufffdo\n]\ufffd\ufffd\ufffd\u0007Kpa\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001dm\ufffdw\ufffd\ufffdl\u0015\ufffd\ufffd1\ufffd\ufffd<\ufffdh\ufffd\u0010z<e\ufffd\ufffd:\n\ufffd\ufffd^\ufffdx",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_r\ufffd\ufffdc\ufffd\ufffd.\u0012Zb\ufffd8Tj\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0005\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\f\ufffdo\n]\ufffd\ufffd\ufffd\u0007Kpa\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca133dfb078cc26b560a6b9e19b0f54849488e7c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_r\ufffd\ufffdc\ufffd\ufffd.\u0012Zb\ufffd8Tj\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0005\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\f\ufffdo\n]\ufffd\ufffd\ufffd\u0007Kpa\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 2377,
"service": "docker-swarm-mgmt",
"service_label_fr": "DOCKER SWARM MGMT"
},
"evidence_snippet": "\ufffd\ufffd\ufffd_r\ufffd\ufffdc\ufffd\ufffd.Zb\ufffd8Tj\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\ufffdo\n]\ufffd\ufffd\ufffdKpa\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via DOCKER SWARM MGMT:2377 \u00b7 (reconnaissance)",
"target_port_label": "2377 \u00b7 DOCKER SWARM MGMT",
"emulator_service": "docker-swarm-mgmt",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via DOCKER SWARM MGMT \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "docker-swarm-mgmt",
"service_label_fr": "DOCKER SWARM MGMT",
"dst_port": 2377,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Docker Swarm 24.0",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd_r\ufffd\ufffdc\ufffd\ufffd.\u0012Zb\ufffd8Tj\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0005\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\f\ufffdo\n]\ufffd\ufffd\ufffd\u0007Kpa\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 2377,
"service": "docker-swarm-mgmt",
"service_label_fr": "DOCKER SWARM MGMT"
},
"attack_vector": "port scan syn \u00b7 via DOCKER SWARM MGMT:2377 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd_r\ufffd\ufffdc\ufffd\ufffd.Zb\ufffd8Tj\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffdv\ufffd\ufffd\u03cd\/ \ufffd]$;,\ufffdo\n]\ufffd\ufffd\ufffdKpa\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduWq2@&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "2377 \u00b7 DOCKER SWARM MGMT",
"emulator_service": "docker-swarm-mgmt",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "swarm",
"service_banner": "Docker Swarm 24.0",
"service_os": "linux",
"dst_port": "2377"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
2377,
3215,
3252,
9025
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 1.09,
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cloud-api-probe",
"docker-swarm-mgmt",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_swarm_mgmt_emulated",
"docker_swarm_mgmt_payload",
"net_docker_api_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9025 · Sonde cloud/API (IMDS/metadata)
|
cloud-api-probe
|
Sonde métadonnées cloud
aws imds probe · via Sonde cloud/API (IMDS/metadata):9025 · (tentative d'exploit)
|
Élevée
|
Faible · 38
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
CLOUD-API-PROBE
WAF
—
Recommandation
Surveiller
Tags
cloud_api_probe_emulated
http_get_probe
mozi_pattern
net_aws_imds_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9025
Chemin / cible
—
Service
Sonde cloud/API (IMDS/metadata)
Payload
GET / HTTP/1.1 Host: 62.3.50.33:9025 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Type « aws_imds_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 38
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9025
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9025 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420636c6f75645f6170695f70726f626520726561647920706f72743d393032350d0a",
"emulator_response_len": 46,
"bytes_in": 153,
"payload_entropy": 5.173763477803601,
"port_category": "registered",
"org": "Modat B.V.",
"service": "cloud-api-probe",
"app_proto": "cloud-api-probe",
"asn": 209334,
"country": "CA",
"dst_port": 9025,
"risk_waf": 8,
"risk_classification": 86,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 86,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cf52f713af8f7d0960a70b1b7ae82354a00d2346",
"event_fingerprint": "dd99326fdbe370f95e32c479ab6a1855f95ffa7d",
"classification_reason": "Type \u00ab aws_imds_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 86,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_cloud_metadata",
"service_name": "cloud-api-probe",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "39f92f1a90de5b5591eae83124830f24",
"path_pattern_hash": "5c275b95c236f3a475818c323eb32879"
},
"target_context": {
"dst_port": 9025,
"service": "cloud-api-probe",
"service_name": "cloud-api-probe",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Type \u00ab aws_imds_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"cloud_metadata_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "391879fc51ec4fe85579f2e5d1f41f1ff3ff5a41",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 9025,
"service": "cloud-api-probe",
"service_label_fr": "Sonde cloud\/API (IMDS\/metadata)"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "aws imds probe \u00b7 via Sonde cloud\/API (IMDS\/metadata):9025 \u00b7 (tentative d'exploit)",
"target_port_label": "9025 \u00b7 Sonde cloud\/API (IMDS\/metadata)",
"emulator_service": "cloud-api-probe",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab aws_imds_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab aws_imds_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 18 % \u2014 via Sonde cloud\/API (IMDS\/metadata) \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 86,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "cloud-api-probe",
"service_label_fr": "Sonde cloud\/API (IMDS\/metadata)",
"dst_port": 9025,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cloud-api-probe",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 9025,
"service": "cloud-api-probe",
"service_label_fr": "Sonde cloud\/API (IMDS\/metadata)"
},
"attack_vector": "aws imds probe \u00b7 via Sonde cloud\/API (IMDS\/metadata):9025 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9025\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "9025 \u00b7 Sonde cloud\/API (IMDS\/metadata)",
"emulator_service": "cloud-api-probe",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cloud_api_probe",
"service_banner": "honeypot-cloud-api-probe",
"service_os": "linux",
"dst_port": "9025"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cloud-api-probe",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"cloud_api_probe_emulated",
"http_get_probe",
"mozi_pattern",
"net_aws_imds_probe"
]
}
|
|
|
TCP |
3252 · SAP Diag
|
sap-diag
|
Scan de ports
port scan syn · via SAP Diag:3252 · (reconnaissance)
|
Élevée
|
Moyen · 52
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3252
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3252 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — 6 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3252
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3252 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.149349507257787,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3252,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 52,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "afbe12233e6288c57c63676b8968bd315bc0c84e",
"event_fingerprint": "c951867bbfd08774746275125c2b73f4adbecbda",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "72b9c071c1e2106342d00d277045fe65",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3252,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cfd59c633b9ae817c3726d07bc26ed8fe7bdf13",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3252,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SAP Diag:3252 \u00b7 (reconnaissance)",
"target_port_label": "3252 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3252,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3252,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "port scan syn \u00b7 via SAP Diag:3252 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3252\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3252 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3252"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cloud-api-probe",
"sap-diag"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
3215 · SAP Diag
|
sap-diag
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:3215 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3215
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3215 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 6 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3215
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3215 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 153,
"payload_entropy": 5.149349507257788,
"port_category": "registered",
"org": "Modat B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 209334,
"country": "CA",
"dst_port": 3215,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 34,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "93d3be086025c51ce87c76509cef8a9c5ed755db",
"event_fingerprint": "e09b16a0683e160ce73648693d12113c8a54ecf6",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "536d610fba8bd11065a0ac8088082790",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 3215,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9abd447a4d7001e5cfe14d9a29ba91a01588de1e",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3215,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3215 \u00b7 (sonde \/ probe)",
"target_port_label": "3215 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3215,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 3215,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3215 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3215\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "3215 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3215"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
17925 · TLS
|
tls
|
Scan de ports
port scan syn · via TLS:17925 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17925
Chemin / cible
—
Service
TLS
Payload
� �"�{d/|���N��^��֔Q����0�J��� p� �~R˅Nڱ������I���U� �к7�n�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �"�{d/|���N��^��֔Q����0�J��� p� �~R˅Nڱ������I���U� �к7�n�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �"�{d/|���N��^��֔Q����0�J��� p� �~R˅Nڱ������I���U� �к7�n�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �ID{ ?����Ş�.t�9FR_ݕ�w0g�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.829555281916081,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 17925,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a4bd60780674a7eb9610e691523f7d96f06e58fb",
"event_fingerprint": "7177683e12114b219de352b0bf8d5f5414587ea0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "851648ea415996034f1c8d2856667aaa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 17925,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd{d\/|\ufffd\ufffd\ufffdN\u0012\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\f\ufffd\u043a7\ufffdn\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd{d\/|\ufffd\ufffd\ufffdN\u0012\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\f\ufffd\u043a7\ufffdn\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdID{\n\u0019?\ufffd\ufffd\ufffd\ufffd\u015e\u001a\ufffd.t\ufffd9FR_\u0755\ufffdw0\u000fg\ufffd\u0002\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd{d\/|\ufffd\ufffd\ufffdN\u0012\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\f\ufffd\u043a7\ufffdn\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2dd5a8e666d8563964f0600ccce688e072f2159f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd{d\/|\ufffd\ufffd\ufffdN\u0012\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\f\ufffd\u043a7\ufffdn\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 17925,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\"\ufffd{d\/|\ufffd\ufffd\ufffdN\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\ufffd\u043a7\ufffdn\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "port scan syn \u00b7 via TLS:17925 \u00b7 (reconnaissance)",
"target_port_label": "17925 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 17925,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd{d\/|\ufffd\ufffd\ufffdN\u0012\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\f\ufffd\u043a7\ufffdn\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 17925,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:17925 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\"\ufffd{d\/|\ufffd\ufffd\ufffdN\ufffd\ufffd^\ufffd\ufffd\u0594Q\ufffd\ufffd\ufffd\ufffd0\ufffdJ\ufffd\ufffd\ufffd p\ufffd \ufffd~R\u02c5N\u06b1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffdU\ufffd\ufffd\u043a7\ufffdn\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "17925 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "17925"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
18499 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:18499 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18499
Chemin / cible
—
Service
TLS
Payload
� �������X7W� ?�ؤ�y�97���0B $N�� }ҡBԓ@?49�ң�_=���# ��� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �������X7W� ?�ؤ�y�97���0B $N�� }ҡBԓ@?49�ң�_=���# ��� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �������X7W� ?�ؤ�y�97���0B $N�� }ҡBԓ@?49�ң�_=���# ��� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ � � q=��#� T%G��([a�C���)��#�
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.824150773466455,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 18499,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9bc91ab315acf53b70828bd9f597575e7d865187",
"event_fingerprint": "74233d8168eaf7baa3bd9a1942887344c9c89b04",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "62b2837b4d971e1608f5491ea972bfaf",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18499,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003\ufffd\u000e\ufffd\ufffd\ufffd\ufffdX7\u0019W\u0014\ufffd\u000b?\ufffd\u0624\ufffd\u0003y\ufffd97\b\ufffd\ufffd\ufffd0B $N\u0007\ufffd\ufffd\u001f}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\u0010\ufffd#\u001e\ufffd\ufffd\ufffd\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003\ufffd\u000e\ufffd\ufffd\ufffd\ufffdX7\u0019W\u0014\ufffd\u000b?\ufffd\u0624\ufffd\u0003y\ufffd97\b\ufffd\ufffd\ufffd0B $N\u0007\ufffd\ufffd\u001f}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\u0010\ufffd#\u001e\ufffd\ufffd\ufffd\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\n\ufffd\u001fq=\ufffd\ufffd#\ufffd\rT%G\u0006\ufffd\ufffd([a\ufffdC\ufffd\ufffd\ufffd)\ufffd\ufffd#\ufffd\u0016",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003\ufffd\u000e\ufffd\ufffd\ufffd\ufffdX7\u0019W\u0014\ufffd\u000b?\ufffd\u0624\ufffd\u0003y\ufffd97\b\ufffd\ufffd\ufffd0B $N\u0007\ufffd\ufffd\u001f}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\u0010\ufffd#\u001e\ufffd\ufffd\ufffd\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd76e993cd49e393439667c4e94ec55102ea380f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003\ufffd\u000e\ufffd\ufffd\ufffd\ufffdX7\u0019W\u0014\ufffd\u000b?\ufffd\u0624\ufffd\u0003y\ufffd97\b\ufffd\ufffd\ufffd0B $N\u0007\ufffd\ufffd\u001f}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\u0010\ufffd#\u001e\ufffd\ufffd\ufffd\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18499,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX7W\ufffd?\ufffd\u0624\ufffdy\ufffd97\ufffd\ufffd\ufffd0B $N\ufffd\ufffd}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:18499 \u00b7 (sonde \/ probe)",
"target_port_label": "18499 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18499,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003\ufffd\u000e\ufffd\ufffd\ufffd\ufffdX7\u0019W\u0014\ufffd\u000b?\ufffd\u0624\ufffd\u0003y\ufffd97\b\ufffd\ufffd\ufffd0B $N\u0007\ufffd\ufffd\u001f}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\u0010\ufffd#\u001e\ufffd\ufffd\ufffd\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 18499,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:18499 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX7W\ufffd?\ufffd\u0624\ufffdy\ufffd97\ufffd\ufffd\ufffd0B $N\ufffd\ufffd}\u04a1B\u0513@?49\ufffd\u04a3\ufffd_=\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "18499 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18499"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
17543 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:17543 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17543
Chemin / cible
—
Service
TLS
Payload
� �`���xŭ���9�២��� �R��rj ,=F� �i�� ~�w�7@0z���Eh��Z�D iz)S�~� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �`���xŭ���9�២��� �R��rj
,=F� �i�� ~�w�7@0z���Eh��Z�D iz)S�~� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �`���xŭ���9�២��� �R��rj ,=F� �i�� ~�w�7@0z���Eh��Z�D iz)S�~� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �5m��\��H� 5| �J�ః�q�� OŎ"
Meta JSON brut
{
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.892214504241187,
"port_category": "registered",
"org": "Modat B.V.",
"service": "tls",
"app_proto": "tls",
"asn": 209334,
"country": "CA",
"dst_port": 17543,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7ecd54d7475d59ad58f05e540882edeb1921c08f",
"event_fingerprint": "ad3b08bd2d24b1cc6c53bf7438a7f7d1ae0c7e7d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"payload_hash": "6f2c7af3c47a4d9ab89929d05a383b68",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 17543,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd\ufffd\ufffdx\u016d\u0010\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\u0007\u000b\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd\u001d~\ufffd\u001bw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd\ufffd\ufffdx\u016d\u0010\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\u0007\u000b\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd\u001d~\ufffd\u001bw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u00165m\ufffd\ufffd\\\ufffd\ufffdH\ufffd\f5|\u001e\ufffdJ\ufffd\u0c03\u000e\ufffdq\ufffd\u0017\ufffd\tO\u014e\"",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd\ufffd\ufffdx\u016d\u0010\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\u0007\u000b\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd\u001d~\ufffd\u001bw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa14ffcb31b5ec3984a223a83e65adf5ec419e4c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd\ufffd\ufffdx\u016d\u0010\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\u0007\u000b\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd\u001d~\ufffd\u001bw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 17543,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd`\ufffd\ufffd\ufffdx\u016d\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd~\ufffdw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:17543 \u00b7 (sonde \/ probe)",
"target_port_label": "17543 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 17543,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\ufffd\ufffd\ufffdx\u016d\u0010\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\u0007\u000b\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd\u001d~\ufffd\u001bw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 17543,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:17543 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd`\ufffd\ufffd\ufffdx\u016d\ufffd\ufffd\ufffd9\ufffd\u17e2\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdrj\r,=F\ufffd \ufffdi\ufffd\ufffd~\ufffdw\ufffd7@0z\ufffd\ufffd\ufffdEh\ufffd\ufffdZ\ufffdD iz)S\ufffd~\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "17543 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "17543"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
4040 · SPARK UI
|
spark-ui
|
Scan de ports
port scan syn · via SPARK UI:4040 · (reconnaissance)
|
Élevée
|
Moyen · 48
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SPARK-UI
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_spark_probe
spark_ui_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4040
Chemin / cible
—
Service
SPARK UI
Payload
GET / HTTP/1.1 Host: 62.3.50.33:4040 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 48
Confiance : Confiance 100 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4040
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4040 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420737061726b5f756920726561647920706f72743d343034300d0a",
"emulator_response_len": 39,
"bytes_in": 153,
"payload_entropy": 5.17549329810746,
"port_category": "registered",
"org": "Modat B.V.",
"service": "spark-ui",
"app_proto": "spark-ui",
"asn": 209334,
"country": "CA",
"dst_port": 4040,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7cb0d6ee0b5d7e27cefbd59142137f7e02f1c572",
"event_fingerprint": "0f607f8c99dae7bfec3e179ee28e616c67be7b81",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "spark-ui",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "659352bbb56b0828c2b3a3df84fbf729",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4040,
"service": "spark-ui",
"service_name": "spark-ui",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5d4f2bab5615e2330795349a630e3fb3826f360",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 4040,
"service": "spark-ui",
"service_label_fr": "SPARK UI"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "port scan syn \u00b7 via SPARK UI:4040 \u00b7 (reconnaissance)",
"target_port_label": "4040 \u00b7 SPARK UI",
"emulator_service": "spark-ui",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SPARK UI \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "spark-ui",
"service_label_fr": "SPARK UI",
"dst_port": 4040,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-spark-ui",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 4040,
"service": "spark-ui",
"service_label_fr": "SPARK UI"
},
"attack_vector": "port scan syn \u00b7 via SPARK UI:4040 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4040\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "4040 \u00b7 SPARK UI",
"emulator_service": "spark-ui",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "spark_ui",
"service_banner": "honeypot-spark-ui",
"service_os": "linux",
"dst_port": "4040"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"mysql-galera",
"spark-ui",
"ss7-m3ua"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_spark_probe",
"spark_ui_emulated",
"spark_ui_payload"
]
}
|
|
|
TCP |
2905 · SS7 M3UA
|
ss7-m3ua
|
ss7 probe
ss7 probe · via SS7 M3UA:2905 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SS7-M3UA
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_ss7_probe
ss7_m3ua_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2905
Chemin / cible
—
Service
SS7 M3UA
Payload
GET / HTTP/1.1 Host: 62.3.50.33:2905 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Type « ss7_probe » (signaux protocolaires) · confiance 0%
Confiance classification
18%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2905
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2905 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01000100000000080003000100000000",
"emulator_response_len": 16,
"bytes_in": 153,
"payload_entropy": 5.173763477803601,
"port_category": "registered",
"org": "Modat B.V.",
"service": "ss7-m3ua",
"app_proto": "ss7-m3ua",
"asn": 209334,
"country": "CA",
"dst_port": 2905,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 33,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f296626cfab7ad194d9c7a865552ec9ab338c907",
"event_fingerprint": "e8d15b89f1cc25f90998e04a8baca6b1dfa44b87",
"classification_reason": "Type \u00ab ss7_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.18,
"classification_confidence": 0.18,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "ss7-m3ua",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f8819f1226452765d9a0e93838416789",
"path_pattern_hash": "c1b599f7f093d935e6bfd5a7a537f708"
},
"target_context": {
"dst_port": 2905,
"service": "ss7-m3ua",
"service_name": "ss7-m3ua",
"risk_score": 33
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Type \u00ab ss7_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d99fe67c3aadd8ecae4a8d1b196a56d84979c871",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 2905,
"service": "ss7-m3ua",
"service_label_fr": "SS7 M3UA"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "ss7 probe \u00b7 via SS7 M3UA:2905 \u00b7 (sonde \/ probe)",
"target_port_label": "2905 \u00b7 SS7 M3UA",
"emulator_service": "ss7-m3ua",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ss7_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab ss7_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 18,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "ss7-m3ua",
"service_label_fr": "SS7 M3UA",
"dst_port": 2905,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ss7-m3ua",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 2905,
"service": "ss7-m3ua",
"service_label_fr": "SS7 M3UA"
},
"attack_vector": "ss7 probe \u00b7 via SS7 M3UA:2905 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2905\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "2905 \u00b7 SS7 M3UA",
"emulator_service": "ss7-m3ua",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ss7_m3ua",
"service_banner": "honeypot-ss7-m3ua",
"service_os": "linux",
"dst_port": "2905"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"mysql-galera",
"ss7-m3ua"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_ss7_probe",
"ss7_m3ua_emulated",
"ss7_m3ua_payload"
]
}
|
|
|
TCP |
13306 · MYSQL GALERA
|
mysql-galera
|
mysql galera probe
mysql galera probe · via MYSQL GALERA:13306 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MYSQL-GALERA
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
mysql_galera_emulated
mysql_galera_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
13306
Chemin / cible
—
Service
MYSQL GALERA
Payload
GET / HTTP/1.1 Host: 62.3.50.33:13306 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*
Pourquoi cette classification : Type « mysql_galera_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:13306
User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:13306 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
"emulator_response_len": 60,
"bytes_in": 154,
"payload_entropy": 5.153899408916931,
"port_category": "registered",
"org": "Modat B.V.",
"service": "mysql-galera",
"app_proto": "mysql-galera",
"asn": 209334,
"country": "CA",
"dst_port": 13306,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 34,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "85b37ef82bf9a82c0ec329ddf6640f01f3f875fb",
"event_fingerprint": "9ee06f97dd7bfb7348d47d80db78bc52a048bfab",
"classification_reason": "Type \u00ab mysql_galera_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "mysql-galera",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CA",
"asn": 209334,
"org": "Modat B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ad21b18c750459e712e7565216a030b9",
"path_pattern_hash": "748f941412a0f4bbecef2686677ac7ed"
},
"target_context": {
"dst_port": 13306,
"service": "mysql-galera",
"service_name": "mysql-galera",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"classification_reason": "Type \u00ab mysql_galera_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d357ff5048c19293374ffcf0735a163863c8d27d",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 13306,
"service": "mysql-galera",
"service_label_fr": "MYSQL GALERA"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"attack_vector": "mysql galera probe \u00b7 via MYSQL GALERA:13306 \u00b7 (sonde \/ probe)",
"target_port_label": "13306 \u00b7 MYSQL GALERA",
"emulator_service": "mysql-galera",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mysql_galera_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mysql_galera_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "mysql-galera",
"service_label_fr": "MYSQL GALERA",
"dst_port": 13306,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mysql-galera",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"port": 13306,
"service": "mysql-galera",
"service_label_fr": "MYSQL GALERA"
},
"attack_vector": "mysql galera probe \u00b7 via MYSQL GALERA:13306 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:13306\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: *\/*",
"target_port_label": "13306 \u00b7 MYSQL GALERA",
"emulator_service": "mysql-galera",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mysql_galera",
"service_banner": "honeypot-mysql-galera",
"service_os": "linux",
"dst_port": "13306"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "85.217.149.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"mysql_galera_emulated",
"mysql_galera_payload",
"net_mysql_galera_probe"
]
}
|