Renseignement sur les menaces

Canada

85.217.149.42

FAI Modat B.V. Première vue 10/07/2026 22:11 UTC Dernière vue 26/07/2026 02:46 UTC Risque Moyen

Période analysée : 2026-04-27 → 2026-07-26

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via TLS — campagne /24 (85.217.149.0/24)

Campagne de scan — plusieurs IP du même /24 (85.217.149.0/24, ≥3 pairs)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 51/100 Moyen

Première observation 10/07/2026 22:11 UTC

Dernière observation 26/07/2026 02:46 UTC

Événements (période) 76

MITRE ATT&CK principal T1046 41 occurrences

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via TLS — campagne /24 (85.217.149.0/24)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +10

Comparaison ASN / FAI

ASN 209334 · 85.217.149.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 76 événements sur la période pour cette IP.

85.217.149.64 Sonde PostgreSQL 26/07/2026 02:57 UTC
85.217.149.46 Sonde PostgreSQL 26/07/2026 02:56 UTC
85.217.149.11 Sonde PostgreSQL 26/07/2026 02:56 UTC
85.217.149.63 Sonde PostgreSQL 26/07/2026 02:56 UTC
85.217.149.45 Sonde PostgreSQL 26/07/2026 02:55 UTC
85.217.149.5 Sonde PostgreSQL 26/07/2026 02:54 UTC
85.217.149.15 Sonde PostgreSQL 26/07/2026 02:53 UTC
85.217.149.9 Sonde PostgreSQL 26/07/2026 02:53 UTC

Événements (filtres)

Première observation

10/07/2026 22:11 UTC

Dernière observation

26/07/2026 02:46 UTC

Dernière activité (filtres)

26/07/2026 02:46 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 34 SAP Diag TCP 19 SCM ACTUATOR PROBE TCP 1 ORACLE TCP 1 EXEC TCP 1 ADMIN PANEL PROBE TCP 1 SMPP TCP 1 RTSP TCP 1 KAFKA CONTROLLER TCP 1 AFP TCP 1 STRATUM TCP 1 RTSP ALT TCP 1 MQTT ALT TCP 1 CLICKHOUSE NATIVE TCP 1 MQTT WSS TCP 1 CMS PROBE TCP 1 WEBLOGIC SNMP TCP 1 SAP Router TCP 1 NRPE TCP 1 DB ADMIN PROBE TCP 1

TLS

SAP Diag

SCM ACTUATOR PROBE

ORACLE

EXEC

ADMIN PANEL PROBE

Géolocalisation

Origine réseau déclarée

Canada unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Modat B.V. 0 Port 25062 postgres_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via TLS:24982 · (reconnaissance)

Détails protocole

Empreinte JA3: 35fa0a83e466acbec1cfbb90
Empreinte JA4: 7b5e3a15097abc10f88e9825

Aperçu payload

��*��)�2��n��\v��\!`��<,�[�f �K�g�"�&9� ��N'U��i�N7��$��&̨̩�/�0�+�,�� /5� {

Port / service

24982 · TLS

Service émulé

TLS

Raison confiance

Confiance 100 % — 3 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan coordonné

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S

Confiance

100% Corrélation +10

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

76 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

76 événement(s) — page 2/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
13/07/2026 06:48:06 UTC	TCP	3261 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3261 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3261 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3261 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3261 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3261 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.1542834125006864, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3261, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "1763eeff5abc5e768b671390761ab0fa2ca8f0e4", "event_fingerprint": "13b49b4fafb720d5bb7058d6d24cdc1e6ded7986", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 48, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "144ee3c4c281c86059a34a848fad4629", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3261, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 48 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4cbffce210fea2d975dbfa2458ad6f088afaf9e5", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3261, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3261 \u00b7 (reconnaissance)", "target_port_label": "3261 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 48, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3261, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3261, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3261 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3261\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3261 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3261" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 3205, 3220, 3228, 3240, 3247, 3251, 3261, 3277, 3279, 3290, 8884, 9009, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.81, "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "clickhouse-native", "mqtt-wss", "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:48:05 UTC	TCP	9009 · CLICKHOUSE NATIVE	clickhouse-native	Scan de ports port scan syn · via CLICKHOUSE NATIVE:9009 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur CLICKHOUSE-NATIVE WAF — Recommandation Investiguer Tags clickhouse_native_emulated clickhouse_native_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9009 Chemin / cible — Service CLICKHOUSE NATIVE Payload GET / HTTP/1.1 Host: 62.3.50.33:9009 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9009 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9009 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "436c69636b486f757365207365727665722076657273696f6e2032342e332e312e0d0a", "emulator_response_len": 35, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "clickhouse-native", "app_proto": "clickhouse-native", "asn": 209334, "country": "CA", "dst_port": 9009, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e7474adc33a37b56ed8e64e4fa3f6673c592e7a3", "event_fingerprint": "a3cb4d107b5137f2b9397a7edc851a39fe91ed0c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "clickhouse-native", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f8886211635d48ae77240c97d15ef8c4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9009, "service": "clickhouse-native", "service_name": "clickhouse-native", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "da7bb3780c09f24da0eb69905c98ff5ff70f135d", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 9009, "service": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)", "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE", "emulator_service": "clickhouse-native", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CLICKHOUSE NATIVE \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE", "dst_port": 9009, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-clickhouse-native", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 9009, "service": "clickhouse-native", "service_label_fr": "CLICKHOUSE NATIVE" }, "attack_vector": "port scan syn \u00b7 via CLICKHOUSE NATIVE:9009 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "9009 \u00b7 CLICKHOUSE NATIVE", "emulator_service": "clickhouse-native", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "clickhouse_native", "service_banner": "honeypot-clickhouse-native", "service_os": "linux", "dst_port": "9009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 3205, 3220, 3228, 3240, 3247, 3251, 3277, 3279, 3290, 8884, 9009, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.65, "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "clickhouse-native", "mqtt-wss", "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "clickhouse_native_emulated", "clickhouse_native_payload", "http_get_probe", "mozi_pattern", "net_clickhouse_probe" ] }
13/07/2026 06:48:03 UTC	TCP	3228 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3228 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3228 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3228 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3228 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3228 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.167355307925522, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3228, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "f8606696d9921fb65d0738a14710ab2b9a5563b8", "event_fingerprint": "5324e9cee3162943361c1abb72aa8db4c05488d8", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 48, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bbd3ff3b1a8038d8625b053f2597373c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3228, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 48 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c9979173cf14f8ea14f2ffd8b7593b9dce6fcb9", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3228, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3228 \u00b7 (reconnaissance)", "target_port_label": "3228 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 48, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3228, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3228, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3228 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3228\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3228 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3228" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 11, "port_scan_ports_sample": [ 3205, 3220, 3228, 3240, 3247, 3251, 3277, 3279, 3290, 8884, 9017 ], "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "mqtt-wss", "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:48:00 UTC	TCP	8884 · MQTT WSS	mqtt-wss	Scan de ports port scan syn · via MQTT WSS:8884 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur MQTT-WSS WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern mqtt_wss_emulated mqtt_wss_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8884 Chemin / cible — Service MQTT WSS Payload GET / HTTP/1.1 Host: 62.3.50.33:8884 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8884 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8884 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "20020000", "emulator_response_len": 4, "bytes_in": 153, "payload_entropy": 5.196703183714235, "port_category": "registered", "org": "Modat B.V.", "service": "mqtt-wss", "app_proto": "mqtt-wss", "asn": 209334, "country": "CA", "dst_port": 8884, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 49, "tag_count": 5, "anomaly_count": 0, "campaign_key": "edeb7190629764eb207a78717a304557b2f70002", "event_fingerprint": "058c0642c8e5b471205eb8c7a317045f3a441eab", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 49, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "mqtt-wss", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "85aca7ea203375c6bc28ea50d9e46d79", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8884, "service": "mqtt-wss", "service_name": "mqtt-wss", "risk_score": 49 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9e22cce1dc5c443fe3e41c054c1627ca63a1b7c4", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 8884, "service": "mqtt-wss", "service_label_fr": "MQTT WSS" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via MQTT WSS:8884 \u00b7 (reconnaissance)", "target_port_label": "8884 \u00b7 MQTT WSS", "emulator_service": "mqtt-wss", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MQTT WSS \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 49, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "mqtt-wss", "service_label_fr": "MQTT WSS", "dst_port": 8884, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mqtt-wss", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 8884, "service": "mqtt-wss", "service_label_fr": "MQTT WSS" }, "attack_vector": "port scan syn \u00b7 via MQTT WSS:8884 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "8884 \u00b7 MQTT WSS", "emulator_service": "mqtt-wss", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mqtt_wss", "service_banner": "honeypot-mqtt-wss", "service_os": "linux", "dst_port": "8884" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 10, "port_scan_ports_sample": [ 3205, 3220, 3240, 3247, 3251, 3277, 3279, 3290, 8884, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.71, "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "mqtt-wss", "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "mqtt_wss_emulated", "mqtt_wss_payload", "net_mqtt_probe" ] }
13/07/2026 06:47:56 UTC	TCP	3247 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3247 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3247 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3247 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3247 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3247 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3247, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 51, "tag_count": 6, "anomaly_count": 0, "campaign_key": "e3548e30cd7d5b29ebb1638ed3f3398c641bf634", "event_fingerprint": "351b2a1647429a559180975c62ee01cc4a1f462d", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8dd24079084c48a9faae15dd42019416", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3247, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 51 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "17186aac35ba338f70708b5f2f1bb072add1dfbd", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3247, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3247 \u00b7 (reconnaissance)", "target_port_label": "3247 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3247, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3247, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3247 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3247\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3247 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3247" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 3205, 3220, 3240, 3247, 3251, 3277, 3279, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.28, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:56 UTC	TCP	3290 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3290 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3290 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3290 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3290 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3290 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.170559392864561, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3290, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "e1376ba5e26c68464eb3d1ccc929d95e715ed13a", "event_fingerprint": "9e1c5f6b8a5c0b9a7fbbff8045f06a71b4d4486a", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 48, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a0f649ee41057ad842dd0962618f1af6", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3290, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 48 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0acb2058ce2da987a266c49565000e9d15c4d29f", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3290, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3290 \u00b7 (reconnaissance)", "target_port_label": "3290 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 48, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3290, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3290, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3290 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3290\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3290 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3290" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 3205, 3220, 3240, 3247, 3251, 3277, 3279, 3290, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.4, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:55 UTC	TCP	3251 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3251 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3251 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3251 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3251 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3251 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.149349507257788, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3251, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 6.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 51, "tag_count": 6, "anomaly_count": 0, "campaign_key": "9892327cefddde8405ed3d98012ac042ecaf4ea5", "event_fingerprint": "61ff638f39832f87ec4118fd93a7f3a9ebc9d3b6", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9f8a2329cd15225ec19d06896e767cda", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3251, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 51 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "af47e19314255665fa2eacc6b25a700ff2cad6be", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3251, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3251 \u00b7 (reconnaissance)", "target_port_label": "3251 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3251, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3251, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3251 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3251\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3251 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3251" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 3205, 3220, 3240, 3251, 3277, 3279, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.35, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:54 UTC	TCP	9017 · Fuite SCM / Actuator	scm-actuator-probe	Scan de ports port scan syn · via Fuite SCM / Actuator:9017 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SCM-ACTUATOR-PROBE WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_secret_scan scm_actuator_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9017 Chemin / cible — Service Fuite SCM / Actuator Payload GET / HTTP/1.1 Host: 62.3.50.33:9017 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9017 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9017 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742073636d5f6163747561746f725f70726f626520726561647920706f72743d393031370d0a", "emulator_response_len": 49, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "scm-actuator-probe", "app_proto": "scm-actuator-probe", "asn": 209334, "country": "CA", "dst_port": 9017, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 5.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "76513e82cb9287608e2f5d441e91c9266147a437", "event_fingerprint": "f647ab0473f9ff5b61be61117ab3c729e75db389", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 50, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "scm-actuator-probe", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "166f876c4e002b8b0205067f8f922794", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9017, "service": "scm-actuator-probe", "service_name": "scm-actuator-probe", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff40842fd52ae593233dd929ab0e0a7344d925ae", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 9017, "service": "scm-actuator-probe", "service_label_fr": "Fuite SCM \/ Actuator" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via Fuite SCM \/ Actuator:9017 \u00b7 (reconnaissance)", "target_port_label": "9017 \u00b7 Fuite SCM \/ Actuator", "emulator_service": "scm-actuator-probe", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Fuite SCM \/ Actuator \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 50, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "scm-actuator-probe", "service_label_fr": "Fuite SCM \/ Actuator", "dst_port": 9017, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-scm-actuator-probe", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 9017, "service": "scm-actuator-probe", "service_label_fr": "Fuite SCM \/ Actuator" }, "attack_vector": "port scan syn \u00b7 via Fuite SCM \/ Actuator:9017 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9017\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "9017 \u00b7 Fuite SCM \/ Actuator", "emulator_service": "scm-actuator-probe", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "scm_actuator_probe", "service_banner": "honeypot-scm-actuator-probe", "service_os": "linux", "dst_port": "9017" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 3205, 3220, 3240, 3277, 3279, 9017 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 1.43, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "sap-diag", "scm-actuator-probe" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_secret_scan", "scm_actuator_emulated" ], "behavior_alert_count": 1, "behavior_priority": 84 }
13/07/2026 06:47:52 UTC	TCP	3277 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3277 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3277 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3277 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +6 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3277 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3277 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3277, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 51, "tag_count": 6, "anomaly_count": 0, "campaign_key": "0d713b0124b737bd4f822e48da9bd316b37eadb8", "event_fingerprint": "41ef32fdb75916d2b8fa7df45cc591bbcfc16251", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 6 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "18181f3c0ebf4e0d7475140239fe5451", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3277, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 51 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "addd459fa80adeefd264ff1a0affebbf1ce137b7", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3277, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3277 \u00b7 (reconnaissance)", "target_port_label": "3277 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 6 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3277, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "campagne_ports" ], "correlation_flags_labels_fr": [ "Campagne multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +6", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3277, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3277 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3277\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3277 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +6", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3277" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 3205, 3240, 3277, 3279 ], "behavior_alerts": [ "port_scan_campaign" ], "correlation_confidence_boost": 6, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:52 UTC	TCP	3220 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3220 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3220 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3220 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +6 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3220 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3220 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.149349507257787, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3220, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 6.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 51, "tag_count": 6, "anomaly_count": 0, "campaign_key": "4fa33c690cc4c6de0ec26a117d669d41e0749b2d", "event_fingerprint": "0b6122ca95dc7ad11506402b52667616b182df70", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 6 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "38b292dac068ef20a31528421cbc2f97", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3220, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 51 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6455997bb74390356cda6b5b87a01e2d47ca7b39", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3220, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3220 \u00b7 (reconnaissance)", "target_port_label": "3220 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 51, "correlation_boost": 6 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 51, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3220, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": [ "campagne_ports" ], "correlation_flags_labels_fr": [ "Campagne multi-ports" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +6", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3220, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3220 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3220\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3220 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +6", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3220" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 3205, 3220, 3240, 3277, 3279 ], "behavior_alerts": [ "port_scan_campaign" ], "correlation_confidence_boost": 6, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:42 UTC	TCP	3205 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3205 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3205 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3205 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Risque capteur Moyen · 49 Confiance : Confiance 100 % — 6 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3205 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3205 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.152553592196827, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3205, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 49, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c6162a09dc95dba5066f1622178449795612c8e7", "event_fingerprint": "8fcaafbcf536f1301e9d71b931b2aa9aa5b91b5b", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 49 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "598bd949619a6574f78baa76955cf1aa", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 3205, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 49 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5f3c5bd1d1b49c4bbb02f58644f714924d663847", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3205, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via SAP Diag:3205 \u00b7 (reconnaissance)", "target_port_label": "3205 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP Diag", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 49 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3205, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3205, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "port scan syn \u00b7 via SAP Diag:3205 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3205 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3205" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:41 UTC	TCP	3240 · SAP Diag	sap-diag	Sonde SAP Diag/GUI Sonde SAP Diag/GUI · via SAP Diag:3240 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3240 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3240 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0% Confiance classification 0% Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3240 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3240 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.170559392864561, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3240, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "0cc1f9677976aec5eb17183e0f44a8c9e373f181", "event_fingerprint": "981eefb053d8fd69546a15af4523d8c1c12a1937", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7d3d96f6080ac423c85fce361deb0cfd", "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87" }, "target_context": { "dst_port": 3240, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 33 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c4d028b7d6c4f29ac4d0652de242839872221916", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3240, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3240 \u00b7 (sonde \/ probe)", "target_port_label": "3240 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3240, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3240, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3240 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3240\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3240 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3240" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 06:47:35 UTC	TCP	3279 · SAP Diag	sap-diag	Sonde SAP Diag/GUI Sonde SAP Diag/GUI · via SAP Diag:3279 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_diag_probe sap_diag_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3279 Chemin / cible — Service SAP Diag Payload GET / HTTP/1.1 Host: 62.3.50.33:3279 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3279 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3279 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000000534150000000000000000000000000", "emulator_response_len": 19, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "sap-diag", "app_proto": "sap-diag", "asn": 209334, "country": "CA", "dst_port": 3279, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25 }, "risk_score": 34, "tag_count": 6, "anomaly_count": 0, "campaign_key": "55b7c8f0a618b69b7a0c705e433e1cf3133a9136", "event_fingerprint": "7ce43eb8655a17ef7841e00a85cc0cd29f2561b6", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fc5c6b00c8143a9a7085d5755cab5734", "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87" }, "target_context": { "dst_port": 3279, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "426db96e53b47733174c2b113cdc880dd1602168", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3279, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3279 \u00b7 (sonde \/ probe)", "target_port_label": "3279 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 48, "novelty": 25, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 3279, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 3279, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3279 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3279\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3279 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "3279" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_diag_probe", "sap_diag_emulated", "sap_diag_payload", "sap_diag_probe" ] }
13/07/2026 00:09:23 UTC	TCP	512 · EXEC	exec	Scan de ports port scan syn · via EXEC:512 · (reconnaissance)	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur EXEC WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 512 Chemin / cible — Service EXEC Payload GET / HTTP/1.1 Host: 62.3.50.33:512 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / A Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:512 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / A Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:512 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206578656320726561647920706f72743d3531320d0a", "emulator_response_len": 34, "bytes_in": 152, "payload_entropy": 5.147369929077153, "port_category": "well_known", "org": "Modat B.V.", "service": "exec", "app_proto": "exec", "asn": 209334, "country": "CA", "dst_port": 512, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 48, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a5764298de700d0891358273865a8456f46977fc", "event_fingerprint": "66e94e8a4c01481d07903156155b8c06d2111c4b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 48, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "exec", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bd0f2cda828c2e3199fd560acd8bd9fc", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 512, "service": "exec", "service_name": "exec", "risk_score": 48 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "477ff6438e5e27b32a61492fa16843450c3d03b9", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "port": 512, "service": "exec", "service_label_fr": "EXEC" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "attack_vector": "port scan syn \u00b7 via EXEC:512 \u00b7 (reconnaissance)", "target_port_label": "512 \u00b7 EXEC", "emulator_service": "exec", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via EXEC \u2014 multi-protocole (8 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 48, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "exec", "service_label_fr": "EXEC", "dst_port": 512, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-exec", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "port": 512, "service": "exec", "service_label_fr": "EXEC" }, "attack_vector": "port scan syn \u00b7 via EXEC:512 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:512\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "target_port_label": "512 \u00b7 EXEC", "emulator_service": "exec", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "exec", "service_banner": "honeypot-exec", "service_os": "linux", "dst_port": "512" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 512, 548, 554, 1521, 1884, 5666, 6002, 7009 ], "multi_protocol_correlation": true, "multi_protocol_count": 8, "multi_protocol_sample": [ "afp", "exec", "mqtt-alt", "nrpe", "oracle", "rtsp", "weblogic-snmp", "x11-2" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
13/07/2026 00:09:16 UTC	TCP	1521 · ORACLE	oracle	Scan de ports port scan syn · via ORACLE:1521 · (reconnaissance)	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur ORACLE WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_oracle_tns_probe oracle_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1521 Chemin / cible — Service ORACLE Payload GET / HTTP/1.1 Host: 62.3.50.33:1521 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1521 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1521 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "0025004a0000060000000000284143434550542844454144424545462900000000000000000000", "emulator_response_len": 39, "bytes_in": 153, "payload_entropy": 5.146966971463015, "port_category": "registered", "org": "Modat B.V.", "service": "oracle", "app_proto": "oracle", "asn": 209334, "country": "CA", "dst_port": 1521, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 47, "tag_count": 5, "anomaly_count": 0, "campaign_key": "0bea4b8d063e5fabd9fdffbc249bf619b042e6ac", "event_fingerprint": "5e232d65a022f2a64f918c38abebffe661d59604", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 47, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "oracle", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f54323d6a7a3507614f359282fa6641e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1521, "service": "oracle", "service_name": "oracle", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4619708378a644cb854ee7493c836c22d1dd168", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 1521, "service": "oracle", "service_label_fr": "ORACLE" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via ORACLE:1521 \u00b7 (reconnaissance)", "target_port_label": "1521 \u00b7 ORACLE", "emulator_service": "oracle", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ORACLE \u2014 multi-protocole (7 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 47, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 47, "risk_label": "Moyen", "service_name": "oracle", "service_label_fr": "ORACLE", "dst_port": 1521, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 1521, "service": "oracle", "service_label_fr": "ORACLE" }, "attack_vector": "port scan syn \u00b7 via ORACLE:1521 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1521\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1521 \u00b7 ORACLE", "emulator_service": "oracle", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle", "service_banner": "honeypot-oracle", "service_os": "linux", "dst_port": "1521" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 548, 554, 1521, 1884, 5666, 6002, 7009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.63, "multi_protocol_correlation": true, "multi_protocol_count": 7, "multi_protocol_sample": [ "afp", "mqtt-alt", "nrpe", "oracle", "rtsp", "weblogic-snmp", "x11-2" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_oracle_tns_probe", "oracle_emulated", "oracle_payload" ] }
13/07/2026 00:09:13 UTC	TCP	5666 · NRPE	nrpe	Scan de ports port scan syn · via NRPE:5666 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur NRPE WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_nrpe_probe nrpe_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5666 Chemin / cible — Service NRPE Payload GET / HTTP/1.1 Host: 62.3.50.33:5666 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5666 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5666 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206e72706520726561647920706f72743d353636360d0a", "emulator_response_len": 35, "bytes_in": 153, "payload_entropy": 5.157487497439726, "port_category": "registered", "org": "Modat B.V.", "service": "nrpe", "app_proto": "nrpe", "asn": 209334, "country": "CA", "dst_port": 5666, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ecb2d2b23aac78c8e304af49022265a1771827ac", "event_fingerprint": "259492869c5b150751c859848608f1bc434e52fc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "nrpe", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c7ccf5c058984e0214e03dda17e382a6", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5666, "service": "nrpe", "service_name": "nrpe", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e3662309e3adf55c634f8c159cbc89611aea98ad", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 5666, "service": "nrpe", "service_label_fr": "NRPE" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via NRPE:5666 \u00b7 (reconnaissance)", "target_port_label": "5666 \u00b7 NRPE", "emulator_service": "nrpe", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NRPE \u2014 multi-protocole (6 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "nrpe", "service_label_fr": "NRPE", "dst_port": 5666, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-nrpe", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 5666, "service": "nrpe", "service_label_fr": "NRPE" }, "attack_vector": "port scan syn \u00b7 via NRPE:5666 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5666\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "5666 \u00b7 NRPE", "emulator_service": "nrpe", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "nrpe", "service_banner": "honeypot-nrpe", "service_os": "linux", "dst_port": "5666" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 548, 554, 1884, 5666, 6002, 7009 ], "multi_protocol_correlation": true, "multi_protocol_count": 6, "multi_protocol_sample": [ "afp", "mqtt-alt", "nrpe", "rtsp", "weblogic-snmp", "x11-2" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_nrpe_probe", "nrpe_emulated", "nrpe_payload" ] }
13/07/2026 00:09:11 UTC	TCP	6002 · X11 2	x11-2	Scan de ports port scan syn · via X11 2:6002 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur X11-2 WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6002 Chemin / cible — Service X11 2 Payload GET / HTTP/1.1 Host: 62.3.50.33:6002 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6002 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6002 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a", "emulator_response_len": 36, "bytes_in": 153, "payload_entropy": 5.157487497439726, "port_category": "registered", "org": "Modat B.V.", "service": "x11-2", "app_proto": "x11-2", "asn": 209334, "country": "CA", "dst_port": 6002, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e89ed91193c6c38411b081b9603248c27c615c04", "event_fingerprint": "92a505b7a4b1ed70159d9f97054b022dcfe7159c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 49, "correlation_boost": 24 }, "named_classification_skipped": false, "service_name": "x11-2", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4bb48ae36fa79cd0de8ec3741b2415db", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 6002, "service": "x11-2", "service_name": "x11-2", "risk_score": 49 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "811e3bdbbe32d375f3dfba41fb3e1a373897908a", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via X11 2:6002 \u00b7 (reconnaissance)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via X11 2 \u2014 multi-protocole (5 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 49, "correlation_boost": 24 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "x11-2", "service_label_fr": "X11 2", "dst_port": 6002, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-2", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +24", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "port scan syn \u00b7 via X11 2:6002 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_2", "service_banner": "honeypot-x11-2", "service_os": "linux", "dst_port": "6002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 548, 554, 1884, 6002, 7009 ], "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "afp", "mqtt-alt", "rtsp", "weblogic-snmp", "x11-2" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 24, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
13/07/2026 00:09:08 UTC	TCP	1884 · MQTT ALT	mqtt-alt	Scan de ports port scan syn · via MQTT ALT:1884 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur MQTT-ALT WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern mqtt_alt_emulated mqtt_alt_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1884 Chemin / cible — Service MQTT ALT Payload GET / HTTP/1.1 Host: 62.3.50.33:1884 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +28 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1884 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1884 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "bytes_in": 153, "payload_entropy": 5.193499098775195, "port_category": "registered", "org": "Modat B.V.", "service": "mqtt-alt", "app_proto": "mqtt-alt", "asn": 209334, "country": "CA", "dst_port": 1884, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e662eb55add9d12cd5eacd8584ff14054ab511e1", "event_fingerprint": "85d179d3841ae5495d4d3c90b2f3163120ed95ff", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 28 }, "named_classification_skipped": false, "service_name": "mqtt-alt", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8cd2ea665b9f53955acf967d6faf59c8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1884, "service": "mqtt-alt", "service_name": "mqtt-alt", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5f7f75519163362bc563b23b185dd05de786b1d7", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 1884, "service": "mqtt-alt", "service_label_fr": "MQTT ALT" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via MQTT ALT:1884 \u00b7 (reconnaissance)", "target_port_label": "1884 \u00b7 MQTT ALT", "emulator_service": "mqtt-alt", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MQTT ALT \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 28 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "mqtt-alt", "service_label_fr": "MQTT ALT", "dst_port": 1884, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mqtt-alt", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +28", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 1884, "service": "mqtt-alt", "service_label_fr": "MQTT ALT" }, "attack_vector": "port scan syn \u00b7 via MQTT ALT:1884 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1884\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1884 \u00b7 MQTT ALT", "emulator_service": "mqtt-alt", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mqtt_alt", "service_banner": "honeypot-mqtt-alt", "service_os": "linux", "dst_port": "1884" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 548, 554, 1884, 7009 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.01, "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "afp", "mqtt-alt", "rtsp", "weblogic-snmp" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 28, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "mqtt_alt_emulated", "mqtt_alt_payload", "net_mqtt_probe" ] }
13/07/2026 00:09:05 UTC	TCP	554 · RTSP	rtsp	Botnet Mozi mozi pattern · via RTSP:554 · (commande & contrôle)	Élevée	Faible · 38
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0011 TA0011 Protocole Émulateur RTSP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 554 Chemin / cible — Service RTSP Payload GET / HTTP/1.1 Host: 62.3.50.33:554 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / A Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 38 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:554 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / A Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:554 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a", "emulator_response_len": 63, "bytes_in": 152, "payload_entropy": 5.165494188959808, "port_category": "well_known", "org": "Modat B.V.", "service": "rtsp", "app_proto": "rtsp", "asn": 209334, "country": "CA", "dst_port": 554, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 38, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8662074027229f4d1829dee2931f8616690fd39d", "event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 38, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "rtsp", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8d42cd427abe8612d08dd697498a1d82", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 554, "service": "rtsp", "service_name": "rtsp", "risk_score": 38 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e198942e2b125607459bead7ad6c1696debefe27", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "attack_vector": "mozi pattern \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 8 % \u2014 via RTSP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 38, "correlation_boost": 8 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 38, "risk_label": "Faible", "service_name": "rtsp", "service_label_fr": "RTSP", "dst_port": 554, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtsp", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "port": 554, "service": "rtsp", "service_label_fr": "RTSP" }, "attack_vector": "mozi pattern \u00b7 via RTSP:554 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "target_port_label": "554 \u00b7 RTSP", "emulator_service": "rtsp", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtsp", "service_banner": "honeypot-rtsp", "service_os": "linux", "dst_port": "554" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "rtsp", "weblogic-snmp" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
13/07/2026 00:09:05 UTC	TCP	548 · AFP	afp	Scan de ports port scan syn · via AFP:548 · (reconnaissance)	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur AFP WAF — Recommandation Investiguer Tags afp_emulated afp_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 548 Chemin / cible — Service AFP Payload GET / HTTP/1.1 Host: 62.3.50.33:548 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / A Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:548 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / A Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:548 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "01040000000000000000000041465056657273696f6e20332e330d10000612000000", "emulator_response_len": 34, "bytes_in": 152, "payload_entropy": 5.186843613287679, "port_category": "well_known", "org": "Modat B.V.", "service": "afp", "app_proto": "afp", "asn": 209334, "country": "CA", "dst_port": 548, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e488fbf2d3bf136c039135cb3dd85a77700a6aa0", "event_fingerprint": "c39041e6bd484a93642438f1798ac254b5043bb8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "afp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2e57170dc6866c162169f82bb68f360f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 548, "service": "afp", "service_name": "afp", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5334028d82da225285db1c2f533f7ca5e9c23bac", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "port": 548, "service": "afp", "service_label_fr": "AFP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)", "target_port_label": "548 \u00b7 AFP", "emulator_service": "afp", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via AFP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 50, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "afp", "service_label_fr": "AFP", "dst_port": 548, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-afp", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "port": 548, "service": "afp", "service_label_fr": "AFP" }, "attack_vector": "port scan syn \u00b7 via AFP:548 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:548\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nA", "target_port_label": "548 \u00b7 AFP", "emulator_service": "afp", "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "afp", "service_banner": "honeypot-afp", "service_os": "linux", "dst_port": "548" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 1.62, "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "afp", "rtsp", "weblogic-snmp" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "afp_emulated", "afp_payload", "http_get_probe", "mozi_pattern", "net_afp_probe" ] }
13/07/2026 00:09:04 UTC	TCP	7009 · WEBLOGIC SNMP	weblogic-snmp	Botnet Mozi mozi pattern · via WEBLOGIC SNMP:7009 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur WEBLOGIC-SNMP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7009 Chemin / cible — Service WEBLOGIC SNMP Payload GET / HTTP/1.1 Host: 62.3.50.33:7009 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7009 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7009 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207765626c6f6769635f736e6d7020726561647920706f72743d373030390d0a", "emulator_response_len": 44, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "weblogic-snmp", "app_proto": "weblogic-snmp", "asn": 209334, "country": "CA", "dst_port": 7009, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 36, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6abf46273026836c2fa47466d7d181d13a5727e8", "event_fingerprint": "25adfdfabd97337d2377f2a841e40c767279cee4", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "weblogic-snmp", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "df33cd4bef87c2b5763ca30b834cc172", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 7009, "service": "weblogic-snmp", "service_name": "weblogic-snmp", "risk_score": 36 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ef5be133447929995ad2d5407b4156dae8bb87dd", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 7009, "service": "weblogic-snmp", "service_label_fr": "WEBLOGIC SNMP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "mozi pattern \u00b7 via WEBLOGIC SNMP:7009 \u00b7 (commande & contr\u00f4le)", "target_port_label": "7009 \u00b7 WEBLOGIC SNMP", "emulator_service": "weblogic-snmp", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via WEBLOGIC SNMP", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "weblogic-snmp", "service_label_fr": "WEBLOGIC SNMP", "dst_port": 7009, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic-snmp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 7009, "service": "weblogic-snmp", "service_label_fr": "WEBLOGIC SNMP" }, "attack_vector": "mozi pattern \u00b7 via WEBLOGIC SNMP:7009 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7009\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "7009 \u00b7 WEBLOGIC SNMP", "emulator_service": "weblogic-snmp", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic_snmp", "service_banner": "honeypot-weblogic-snmp", "service_os": "linux", "dst_port": "7009" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
11/07/2026 12:29:56 UTC	TCP	17228 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:17228 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17228 Chemin / cible — Service TLS Payload ��Xʭt/i��k��`i��z\|�~ "� jH広Z㧂� �G�1;NqnVt��D�y &̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Xʭt/i��k��`i��z\|�~ "� jH広Z㧂� �G�1;NqnVt��D�y&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��Xʭt/i��k��`i��z\|�~ "� jH広Z㧂� �G�1;NqnVt��D�y &̨̩�/�0�+�,�� /5� { �+ 3&$ �7p}�TP�ҥ�@��s�� H��sg�G Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.858042462226101, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 17228, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e472123e99f6a68b3dcd0b48237dddf1ec6360e8", "event_fingerprint": "28474dc633918679c8c0b0cb8882dccf88e8bc2c", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "9cd62b408cb1695e48a0edf3a1889471", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 17228, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\b\u0017\u001a\u0010\u02adt\u0015\/\u0012i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd\u000b\u001d jH\u5e83Z\u39c2\ufffd \u0019\ufffdG\ufffd\u00001;\u001cNqn\u0018Vt\ufffd\ufffdD\ufffdy\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\b\u0017\u001a\u0010\u02adt\u0015\/\u0012i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd\u000b\u001d jH\u5e83Z\u39c2\ufffd \u0019\ufffdG\ufffd\u00001;\u001cNqn\u0018Vt\ufffd\ufffdD\ufffdy\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u000e7p}\ufffdTP\ufffd\u0019\u04a5\ufffd@\ufffd\ufffd\u001ds\ufffd\ufffd\r\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdsg\ufffdG", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\b\u0017\u001a\u0010\u02adt\u0015\/\u0012i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd\u000b\u001d jH\u5e83Z\u39c2\ufffd \u0019\ufffdG\ufffd\u00001;\u001cNqn\u0018Vt\ufffd\ufffdD\ufffdy\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8371f291c87c4b3431e8faf95651f22539a6045b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\b\u0017\u001a\u0010\u02adt\u0015\/\u0012i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd\u000b\u001d jH\u5e83Z\u39c2\ufffd \u0019\ufffdG\ufffd\u00001;\u001cNqn\u0018Vt\ufffd\ufffdD\ufffdy\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 17228, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdX\u02adt\/i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd jH\u5e83Z\u39c2\ufffd \ufffdG\ufffd1;NqnVt\ufffd\ufffdD\ufffdy&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:17228 \u00b7 (sonde \/ probe)", "target_port_label": "17228 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 17228, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\b\u0017\u001a\u0010\u02adt\u0015\/\u0012i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd\u000b\u001d jH\u5e83Z\u39c2\ufffd \u0019\ufffdG\ufffd\u00001;\u001cNqn\u0018Vt\ufffd\ufffdD\ufffdy\f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 17228, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:17228 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdX\u02adt\/i\ufffd\ufffd\ufffdk\ufffd\ufffd`i\ufffd\ufffdz\|\ufffd~\r\"\ufffd jH\u5e83Z\u39c2\ufffd \ufffdG\ufffd1;NqnVt\ufffd\ufffdD\ufffdy&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "17228 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "17228" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
11/07/2026 12:29:56 UTC	TCP	16439 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:16439 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16439 Chemin / cible — Service TLS Payload ��2zH�K��5��fa/��"�/IYѫ�� Ѳ��`�d��'8(��n3��f�e&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��2zH�K��5��fa/��"�/IYѫ�� Ѳ��`�d��'8(��n3��f�e&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��2zH�K��5��fa/��"�/IYѫ�� Ѳ��`�d��'8(��n3��f�e&̨̩�/�0�+�,�� /5� { �+ 3&$ �@ Car��y~l��U{+w�o@ Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.765580927518678, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 16439, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c17e7af7ccf0acc542d4530a9647cb0f3b0c4968", "event_fingerprint": "378a9c1346ffb4ab16dda44cfa5004af872792dd", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "2ca80dbc097e46fa2052b881e3b34481", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 16439, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd\ufffd\u00072zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\u0019\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd\u0018'8\u001d(\ufffd\u0002\ufffdn3\ufffd\ufffd\ufffdf\ufffd\u001ae\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd\ufffd\u00072zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\u0019\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd\u0018'8\u001d(\ufffd\u0002\ufffdn3\ufffd\ufffd\ufffdf\ufffd\u001ae\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd@\n\u0016\u0014Car\ufffd\ufffd\ufffdy~l\ufffd\ufffd\ufffd\ufffdU\u0013{\u0010\u0014+\u000f\u0003w\ufffdo@", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd\ufffd\u00072zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\u0019\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd\u0018'8\u001d(\ufffd\u0002\ufffdn3\ufffd\ufffd\ufffdf\ufffd\u001ae\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "782f02be1c32a89ff3630c3b24d4d6d7ba5fdea2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd\ufffd\u00072zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\u0019\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd\u0018'8\u001d(\ufffd\u0002\ufffdn3\ufffd\ufffd\ufffdf\ufffd\u001ae\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 16439, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd2zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd'8(\ufffd\ufffdn3\ufffd\ufffd\ufffdf\ufffde&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:16439 \u00b7 (sonde \/ probe)", "target_port_label": "16439 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 16439, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd\ufffd\u00072zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\u0019\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd\u0018'8\u001d(\ufffd\u0002\ufffdn3\ufffd\ufffd\ufffdf\ufffd\u001ae\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 16439, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:16439 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd2zH\ufffdK\ufffd\ufffd\ufffd5\ufffd\ufffdfa\/\ufffd\ufffd\"\ufffd\/IY\u046b\ufffd\ufffd\ufffd \u0472\ufffd\ufffd\ufffd\ufffd`\ufffdd\ufffd\ufffd\ufffd\ufffd'8(\ufffd\ufffdn3\ufffd\ufffd\ufffdf\ufffde&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "16439 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "16439" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
10/07/2026 22:33:32 UTC	TCP	17492 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:17492 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17492 Chemin / cible — Service TLS Payload ����d � �fİjd�b�g��U`�� ݫ��L��q88�� ק�N�;�C��&̨̩�/�0�+�,�� /5� { Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ����d � �fİjd�b�g��U`�� ݫ��L��q88��ק�N�;�C��&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ����d � �fİjd�b�g��U`�� ݫ��L��q88�� ק�N�;�C��&̨̩�/�0�+�,�� /5� { �+ 3&$ :c�>W��n�П ~ �RcR:5��ڷj�z Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.858508213766523, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 17492, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "664addb883c4a32982a9337dd183823e8c7805c2", "event_fingerprint": "3f2fff3ca67a91737327130f04e5d64be80da889", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "fdb35fbde458d54ec6a2b6507f9d866a", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 17492, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffdd \ufffd \ufffd\u0012f\u0130jd\ufffd\u0016b\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\u000b\ufffd\u05e7\ufffdN\ufffd\u0014;\ufffdC\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffdd \ufffd \ufffd\u0012f\u0130jd\ufffd\u0016b\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\u000b\ufffd\u05e7\ufffdN\ufffd\u0014;\ufffdC\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 :c\ufffd>W\u0016\ufffd\ufffd\u0017\ufffdn\ufffd\u041f\r~\f\ufffdRc\u0016R\u0005:5\ufffd\ufffd\u06b7j\ufffdz", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffdd \ufffd \ufffd\u0012f\u0130jd\ufffd\u0016b\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\u000b\ufffd\u05e7\ufffdN\ufffd\u0014;\ufffdC\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7fbe206cf81d96d9e7361c7d7e6a6d031873c81f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffdd \ufffd \ufffd\u0012f\u0130jd\ufffd\u0016b\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\u000b\ufffd\u05e7\ufffdN\ufffd\u0014;\ufffdC\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 17492, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd \ufffd \ufffdf\u0130jd\ufffdb\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\ufffd\u05e7\ufffdN\ufffd;\ufffdC\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:17492 \u00b7 (sonde \/ probe)", "target_port_label": "17492 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 17492, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffdd \ufffd \ufffd\u0012f\u0130jd\ufffd\u0016b\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\u000b\ufffd\u05e7\ufffdN\ufffd\u0014;\ufffdC\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 17492, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:17492 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffdd \ufffd \ufffdf\u0130jd\ufffdb\ufffdg\ufffd\ufffdU`\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u076b\ufffd\ufffdL\ufffd\ufffdq88\ufffd\ufffd\ufffd\u05e7\ufffdN\ufffd;\ufffdC\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "17492 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "17492" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
10/07/2026 22:21:26 UTC	TCP	17444 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:17444 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17444 Chemin / cible — Service TLS Payload ��5��<!�<>�_ģlmɊ�䔎)�>ho ]��!kΩjf$��I�n��%�O�0[} &̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��5��<!�<>�_ģlmɊ�䔎)�>ho ]��!kΩjf$��I�n��%�O�0[} &̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��5��<!�<>�_ģlmɊ�䔎)�>ho ]��!kΩjf$��I�n��%�O�0[} &̨̩�/�0�+�,�� /5� { �+ 3&$ S,��J�=�.�B;[o��Խw�w��y^�R Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.855108126743809, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 17444, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4af1bba1cb8f555036e3b6e7451c53d72d74198e", "event_fingerprint": "3c44ca7dc712db0c7f286bc9f0600c26ee62c385", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "d2939e45dc682b744fc8fb9b8514722f", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 17444, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd5\u0004\u0012\ufffd\ufffd\ufffd<!\ufffd<>\ufffd\u000e_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\u0000\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\u0015\ufffd%\ufffdO\ufffd\u00020[}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd5\u0004\u0012\ufffd\ufffd\ufffd<!\ufffd<>\ufffd\u000e_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\u0000\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\u0015\ufffd%\ufffdO\ufffd\u00020[}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 S,\ufffd\ufffdJ\ufffd=\ufffd.\ufffdB;\u008a[o\u0014\ufffd\ufffd\u053dw\ufffdw\ufffd\ufffdy\u0018^\ufffd\u001fR", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd5\u0004\u0012\ufffd\ufffd\ufffd<!\ufffd<>\ufffd\u000e_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\u0000\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\u0015\ufffd%\ufffdO\ufffd\u00020[}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "58edc7f7716935f809e1414e6a16f3f393de4a05", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd5\u0004\u0012\ufffd\ufffd\ufffd<!\ufffd<>\ufffd\u000e_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\u0000\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\u0015\ufffd%\ufffdO\ufffd\u00020[}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 17444, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd<!\ufffd<>\ufffd_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\ufffd%\ufffdO\ufffd0[}\n&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:17444 \u00b7 (sonde \/ probe)", "target_port_label": "17444 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 17444, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd5\u0004\u0012\ufffd\ufffd\ufffd<!\ufffd<>\ufffd\u000e_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\u0000\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\u0015\ufffd%\ufffdO\ufffd\u00020[}\n\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 17444, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:17444 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd<!\ufffd<>\ufffd_\u0123lm\u024a\ufffd\u450e)\ufffd>ho ]\ufffd\ufffd\ufffd\ufffd\ufffd!k\u03a9jf$\ufffd\ufffd\ufffdI\ufffdn\ufffd\ufffd%\ufffdO\ufffd0[}\n&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "17444 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "17444" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
10/07/2026 22:11:35 UTC	TCP	13296 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:13296 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13296 Chemin / cible — Service TLS Payload ��uhVyG��b��5��ɮ�xZe�O �mL �� S߆��� &̨̩�/�0�+�,�� /5� { Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��uhVyG��b��5��ɮ�xZe�O �mL �� S߆���&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��uhVyG��b��5��ɮ�xZe�O �mL �� S߆��� &̨̩�/�0�+�,�� /5� { �+ 3&$ ų�܉/HBVZ�%df��md� ��s�?K� Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.760457007774495, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 13296, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "36fc9600d3dbed018195d05d11fb876d2ac2fadd", "event_fingerprint": "cd5be76bbb178bf4be28fd3c9fc850de9a760edf", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "7c81b5d9183a669661e1e9f5b6560a65", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 13296, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffduhVyG\u001b\ufffd\ufffd\u0010b\ufffd\ufffd\u0006\u00185\ufffd\u0006\u001b\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffd\u0010mL\n\u0015\ufffd\ufffd\u0015\ufffd\ufffd\u0005\ufffd\ufffd\u0003\ufffd\rS\u0018\u07c6\ufffd\u0011\ufffd\ufffd\ufffd\u0016\ufffd\u0007\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffduhVyG\u001b\ufffd\ufffd\u0010b\ufffd\ufffd\u0006\u00185\ufffd\u0006\u001b\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffd\u0010mL\n\u0015\ufffd\ufffd\u0015\ufffd\ufffd\u0005\ufffd\ufffd\u0003\ufffd\rS\u0018\u07c6\ufffd\u0011\ufffd\ufffd\ufffd\u0016\ufffd\u0007\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0173\ufffd\u0017\u0709\/HBVZ\ufffd%df\u001a\ufffd\ufffdmd\ufffd\n\ufffd\ufffd\ufffd\ufffds\ufffd?K\ufffd\u0012", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffduhVyG\u001b\ufffd\ufffd\u0010b\ufffd\ufffd\u0006\u00185\ufffd\u0006\u001b\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffd\u0010mL\n\u0015\ufffd\ufffd\u0015\ufffd\ufffd\u0005\ufffd\ufffd\u0003\ufffd\rS\u0018\u07c6\ufffd\u0011\ufffd\ufffd\ufffd\u0016\ufffd\u0007\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "41228f180650610463e3e6a11842fa301de19eae", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffduhVyG\u001b\ufffd\ufffd\u0010b\ufffd\ufffd\u0006\u00185\ufffd\u0006\u001b\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffd\u0010mL\n\u0015\ufffd\ufffd\u0015\ufffd\ufffd\u0005\ufffd\ufffd\u0003\ufffd\rS\u0018\u07c6\ufffd\u0011\ufffd\ufffd\ufffd\u0016\ufffd\u0007\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 13296, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffduhVyG\ufffd\ufffdb\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffdmL\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rS\u07c6\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:13296 \u00b7 (sonde \/ probe)", "target_port_label": "13296 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 13296, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffduhVyG\u001b\ufffd\ufffd\u0010b\ufffd\ufffd\u0006\u00185\ufffd\u0006\u001b\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffd\u0010mL\n\u0015\ufffd\ufffd\u0015\ufffd\ufffd\u0005\ufffd\ufffd\u0003\ufffd\rS\u0018\u07c6\ufffd\u0011\ufffd\ufffd\ufffd\u0016\ufffd\u0007\u000b\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 13296, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:13296 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffduhVyG\ufffd\ufffdb\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\u026e\ufffdxZe\ufffdO \ufffdmL\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rS\u07c6\ufffd*\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "13296 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "13296" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }

85.217.149.42

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence