Renseignement sur les menaces

Canada

85.217.149.70

FAI Modat B.V. Première vue 12/07/2026 03:03 UTC Dernière vue 21/07/2026 14:09 UTC Risque Moyen

Période analysée : 2026-06-21 → 2026-07-21

Activité suspecte · risque 34/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 62/100 Moyen

Première observation 12/07/2026 03:03 UTC

Dernière observation 21/07/2026 14:09 UTC

Événements (période) 85

MITRE ATT&CK principal T1046 70 occurrences

Activité suspecte · risque 34/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « minecraft_probe » (signaux protocolaires) · confiance 0%

Confiance 0 % — 4 signal(aux) capteur

Comparaison ASN / FAI

ASN 209334 · 85.217.149.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 85 événements sur la période pour cette IP.

85.217.149.23 Sonde SIP/VoIP 21/07/2026 16:39 UTC
85.217.149.63 Sonde port 21/07/2026 16:24 UTC
85.217.149.41 Sonde port 21/07/2026 16:23 UTC
85.217.149.53 Sonde port 21/07/2026 16:23 UTC
85.217.149.14 Sonde port 21/07/2026 16:23 UTC
85.217.149.21 Sonde port 21/07/2026 16:23 UTC
85.217.149.12 Sonde port 21/07/2026 16:23 UTC
85.217.149.35 Sonde port 21/07/2026 16:22 UTC

Événements (filtres)

Première observation

12/07/2026 03:03 UTC

Dernière observation

21/07/2026 14:09 UTC

Dernière activité (filtres)

21/07/2026 14:09 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 72 TLS TCP 11 SMTP SUBMISSION TCP 1 MINECRAFT TCP 1

HTTP

TLS

SMTP SUBMISSION

MINECRAFT

Géolocalisation

Origine réseau déclarée

Canada unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Modat B.V. 0 Port 25565 minecraft_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

minecraft probe · via MINECRAFT:25565 · (sonde / probe)

Détails protocole

Aperçu payload

GET / HTTP/1.1 Host: 62.3.50.33:25565 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: */*

Port / service

25565 · MINECRAFT

Service émulé

MINECRAFT

Raison confiance

Confiance 0 % — 4 signal(aux) capteur

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

0% Confiance modérée — signal unique

Famille de menace

game_server_scan

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

85 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

85 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
21/07/2026 14:09:00 UTC	TCP	25565 · MINECRAFT	minecraft	minecraft probe minecraft probe · via MINECRAFT:25565 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MINECRAFT WAF — Recommandation Surveiller Tags http_get_probe minecraft_emulated mozi_pattern net_minecraft_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 25565 Chemin / cible — Service MINECRAFT Payload GET / HTTP/1.1 Host: 62.3.50.33:25565 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:25565 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:25565 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "ff787b2276657273696f6e223a7b226e616d65223a22312e32302e34222c2270726f746f636f6c223a3736357d2c22706c6179657273223a7b226d6178223a32302c226f6e6c696e65223a337d2c226465736372697074696f6e223a7b2274657874223a22486f6e6579706f74204d696e656372616674227d7d", "emulator_response_len": 122, "bytes_in": 154, "payload_entropy": 5.157082688109613, "port_category": "registered", "org": "Modat B.V.", "service": "minecraft", "app_proto": "minecraft", "asn": 209334, "country": "CA", "dst_port": 25565, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 34, "tag_count": 4, "anomaly_count": 0, "campaign_key": "6fb07954219bacb3729ff0aa88627fdd59e82133", "event_fingerprint": "693ecbb9a1e86d78b2b00f4d400ad992bafdc5d5", "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "minecraft", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0373a900b2d876774f745d3ba1139824", "path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db" }, "target_context": { "dst_port": 25565, "service": "minecraft", "service_name": "minecraft", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "game_server_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f1382390da15e08703bf9088ed463d0d056d539", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 25565, "service": "minecraft", "service_label_fr": "MINECRAFT" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "minecraft probe \u00b7 via MINECRAFT:25565 \u00b7 (sonde \/ probe)", "target_port_label": "25565 \u00b7 MINECRAFT", "emulator_service": "minecraft", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "minecraft", "service_label_fr": "MINECRAFT", "dst_port": 25565, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-minecraft", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "port": 25565, "service": "minecraft", "service_label_fr": "MINECRAFT" }, "attack_vector": "minecraft probe \u00b7 via MINECRAFT:25565 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:25565\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "25565 \u00b7 MINECRAFT", "emulator_service": "minecraft", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "minecraft", "service_banner": "honeypot-minecraft", "service_os": "linux", "dst_port": "25565" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "minecraft_emulated", "mozi_pattern", "net_minecraft_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
12/07/2026 15:34:36 UTC	TCP	18292 · TLS	tls	Scan de ports port scan syn · via TLS:18292 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 TA0043 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18292 Chemin / cible — Service TLS Payload ��}��s��ɋ�=s�~��:��ʜ�֒��` ��X��-�5͵�60��3 \��On&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��}��s��ɋ�=s�~��:��ʜ�֒��` ��X��-�5͵�60��3 \��On&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��}��s��ɋ�=s�~��:��ʜ�֒��` ��X��-�5͵�60��3 \��On&̨̩�/�0�+�,�� /5� { �+ 3&$ ��g5'�PRɑ�\R>��\|��\|�<׊+ Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.823461304334606, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 18292, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "72e070ebbbceedf6564cc45888d0663e09f9569e", "event_fingerprint": "6f44114bbfaab0d62b66fcac0aeb83c1ff0fe600", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "9412eef668203801c0898dd642b2082c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 18292, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \u0015\ufffd\u0003\u001b\ufffdX\ufffd\u0005\u0013\u0011\ufffd\ufffd\ufffd-\ufffd5\u0375\u0015\ufffd60\ufffd\ufffd\u00113\r\\\ufffd\ufffdOn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \u0015\ufffd\u0003\u001b\ufffdX\ufffd\u0005\u0013\u0011\ufffd\ufffd\ufffd-\ufffd5\u0375\u0015\ufffd60\ufffd\ufffd\u00113\r\\\ufffd\ufffdOn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdg5'\ufffdPR\u0251\u0011\ufffd\\\u001aR>\u001e\ufffd\ufffd\|\ufffd\ufffd\|\ufffd<\u0017\u05ca+", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \u0015\ufffd\u0003\u001b\ufffdX\ufffd\u0005\u0013\u0011\ufffd\ufffd\ufffd-\ufffd5\u0375\u0015\ufffd60\ufffd\ufffd\u00113\r\\\ufffd\ufffdOn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "02a421a2ae176f1e12e051aaf5ac2b49a7cedd04", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \u0015\ufffd\u0003\u001b\ufffdX\ufffd\u0005\u0013\u0011\ufffd\ufffd\ufffd-\ufffd5\u0375\u0015\ufffd60\ufffd\ufffd\u00113\r\\\ufffd\ufffdOn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 18292, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd-\ufffd5\u0375\ufffd60\ufffd\ufffd3\r\\\ufffd\ufffdOn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "port scan syn \u00b7 via TLS:18292 \u00b7 (reconnaissance)", "target_port_label": "18292 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18292, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \u0015\ufffd\u0003\u001b\ufffdX\ufffd\u0005\u0013\u0011\ufffd\ufffd\ufffd-\ufffd5\u0375\u0015\ufffd60\ufffd\ufffd\u00113\r\\\ufffd\ufffdOn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 18292, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:18292 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd}\ufffd\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\u024b\ufffd=s\ufffd~\ufffd\ufffd:\ufffd\ufffd\u029c\ufffd\u0592\ufffd\ufffd\ufffd` \ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd-\ufffd5\u0375\ufffd60\ufffd\ufffd3\r\\\ufffd\ufffdOn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "18292 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18292" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 18, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:34:23 UTC	TCP	18383 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:18383 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18383 Chemin / cible — Service TLS Payload �� #[��rTJ#ŻIU;�oB䥠�Rqp ��A.�� \|AR ��ȄP{�Fl�]��l$4�&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��#[��rTJ#ŻIU;�oB䥠�Rqp ��A.�� \|AR��ȄP{�Fl�]��l$4�&̨̩�/�0�+�,�� /5� { Requête brute (extrait) �� #[��rTJ#ŻIU;�oB䥠�Rqp ��A.�� \|AR ��ȄP{�Fl�]��l$4�&̨̩�/�0�+�,�� /5� { �+ 3&$ e}��CW��gћJ��I�� \: . Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.904373427872393, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 18383, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3f6de1d1f9a7a1d8eea93a1de72bb6d3e56f43a4", "event_fingerprint": "44a1d21a8881e6ede07b14b8d8d6600a32b114f8", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "7b70356cd51b70711565d6eb25d40d3d", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 18383, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u001d#[\ufffd\ufffd\ufffd\ufffd\ufffd\u000frTJ#\u017bIU;\ufffdoB\u4960\ufffdR\u0011qp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\u000b\ufffd\ufffd\u0204P{\u0016\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u001d#[\ufffd\ufffd\ufffd\ufffd\ufffd\u000frTJ#\u017bIU;\ufffdoB\u4960\ufffdR\u0011qp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\u000b\ufffd\ufffd\u0204P{\u0016\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0012e}\u000e\ufffd\u001f\ufffdCW\ufffd\ufffd\ufffd\ufffdg\u045bJ\ufffd\ufffd\ufffd\u0010\ufffdI\ufffd\ufffd \\:\u000b.", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u001d#[\ufffd\ufffd\ufffd\ufffd\ufffd\u000frTJ#\u017bIU;\ufffdoB\u4960\ufffdR\u0011qp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\u000b\ufffd\ufffd\u0204P{\u0016\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ea866c6cd0929c6be1b850c860427da769ca6f54", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u001d#[\ufffd\ufffd\ufffd\ufffd\ufffd\u000frTJ#\u017bIU;\ufffdoB\u4960\ufffdR\u0011qp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\u000b\ufffd\ufffd\u0204P{\u0016\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 18383, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd#[\ufffd\ufffd\ufffd\ufffd\ufffdrTJ#\u017bIU;\ufffdoB\u4960\ufffdRqp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\ufffd\ufffd\u0204P{\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:18383 \u00b7 (sonde \/ probe)", "target_port_label": "18383 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18383, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000b\u001d#[\ufffd\ufffd\ufffd\ufffd\ufffd\u000frTJ#\u017bIU;\ufffdoB\u4960\ufffdR\u0011qp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\u000b\ufffd\ufffd\u0204P{\u0016\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 18383, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:18383 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd#[\ufffd\ufffd\ufffd\ufffd\ufffdrTJ#\u017bIU;\ufffdoB\u4960\ufffdRqp \ufffd\ufffdA.\ufffd\ufffd\r\ufffd\|AR\ufffd\ufffd\u0204P{\ufffdFl\ufffd]\ufffd\ufffd\ufffdl$4\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "18383 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18383" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 19, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:34:22 UTC	TCP	18303 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:18303 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18303 Chemin / cible — Service TLS Payload ��}1�8��^��P��f� Ǥ�P �,[_ ��"��f�}��.��p� �Θ&̨̩�/�0�+�,�� /5� { Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��}1�8��^��P��f� Ǥ�P �,[_ ��"��f�}��.��p� �Θ&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��}1�8��^��P��f� Ǥ�P �,[_ ��"��f�}��.��p� �Θ&̨̩�/�0�+�,�� /5� { �+ 3&$ j)C_�b�8�qduj�� ϣ�L� Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.700117750018634, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 18303, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "9f3ada863fdcfaa873fb3e790426190b8b9af548", "event_fingerprint": "ac0015d6bfbb4b53d56569b424db7df7f5a831d0", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "79ef471c2fc70bfbc9194dc233ce51a2", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 18303, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\u001d\ufffdf\ufffd\n\u01e4\ufffd\u0013P\t\ufffd\u0004,[\u0001\u0014_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0013f\u0010\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004.\ufffd\u0005\ufffdp\ufffd \ufffd\u0398\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\u001d\ufffdf\ufffd\n\u01e4\ufffd\u0013P\t\ufffd\u0004,[\u0001\u0014_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0013f\u0010\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004.\ufffd\u0005\ufffdp\ufffd \ufffd\u0398\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 j)C_\ufffdb\ufffd8\ufffd\u0018\u001f\u001bqd\u0003uj\ufffd\u0003\ufffd\n\ufffd\ufffd\u0011\u03e3\ufffdL\ufffd\u0006", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\u001d\ufffdf\ufffd\n\u01e4\ufffd\u0013P\t\ufffd\u0004,[\u0001\u0014_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0013f\u0010\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004.\ufffd\u0005\ufffdp\ufffd \ufffd\u0398\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8550e81930f88fd8621bc7ef71b30ab35d9a9ce0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\u001d\ufffdf\ufffd\n\u01e4\ufffd\u0013P\t\ufffd\u0004,[\u0001\u0014_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0013f\u0010\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004.\ufffd\u0005\ufffdp\ufffd \ufffd\u0398\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 18303, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffdf\ufffd\n\u01e4\ufffdP\t\ufffd,[_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffdf\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffdp\ufffd \ufffd\u0398&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:18303 \u00b7 (sonde \/ probe)", "target_port_label": "18303 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18303, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\u001d\ufffdf\ufffd\n\u01e4\ufffd\u0013P\t\ufffd\u0004,[\u0001\u0014_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\u0013f\u0010\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004.\ufffd\u0005\ufffdp\ufffd \ufffd\u0398\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 18303, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:18303 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd}1\ufffd8\ufffd\ufffd^\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffdf\ufffd\n\u01e4\ufffdP\t\ufffd,[_ \ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffdf\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*.\ufffd\ufffdp\ufffd \ufffd\u0398&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "18303 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18303" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 19, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:27:42 UTC	TCP	14301 · TLS	tls	Scan de ports port scan syn · via TLS:14301 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14301 Chemin / cible — Service TLS Payload ��,mD!$�S�j:��e��ݷ<$w2�ǜ?� �Ց�X��EVp��op�W �!z^��&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +16 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��,mD!$�S�j:��e��ݷ<$w2�ǜ?� �Ց�X��EVp��op�W �!z^��&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��,mD!$�S�j:��e��ݷ<$w2�ǜ?� �Ց�X��EVp��op�W �!z^��&̨̩�/�0�+�,�� /5� { �+ 3&$ � {>6�5�<��)��?��E�]��S Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.791147417071127, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 14301, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "97e48e6f28186140fb1a5ccaa34db5d52d7c0156", "event_fingerprint": "0623a21aee96c9e1d68dd12f699960a2890473c4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 16 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "5ab87e1d88be17771142540554a2ad10", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 14301, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u0004mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w\u00182\ufffd\u01dc?\ufffd \ufffd\u0012\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\u0006\u001b\ufffdop\ufffdW\n\u000b\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u0004mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w\u00182\ufffd\u01dc?\ufffd \ufffd\u0012\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\u0006\u001b\ufffdop\ufffdW\n\u000b\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u000b{>\u00056\ufffd5\ufffd<\ufffd\ufffd)\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0001]\ufffd\ufffd\ufffdS", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u0004mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w\u00182\ufffd\u01dc?\ufffd \ufffd\u0012\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\u0006\u001b\ufffdop\ufffdW\n\u000b\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "116ef4e11daa97c093a07e53da793c9d0a7dcf3f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u0004mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w\u00182\ufffd\u01dc?\ufffd \ufffd\u0012\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\u0006\u001b\ufffdop\ufffdW\n\u000b\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14301, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd,mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w2\ufffd\u01dc?\ufffd \ufffd\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\ufffdop\ufffdW\n\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "port scan syn \u00b7 via TLS:14301 \u00b7 (reconnaissance)", "target_port_label": "14301 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 16 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14301, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +16", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u0004mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w\u00182\ufffd\u01dc?\ufffd \ufffd\u0012\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\u0006\u001b\ufffdop\ufffdW\n\u000b\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14301, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:14301 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd,mD!$\ufffdS\ufffdj:\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\u0777<$w2\ufffd\u01dc?\ufffd \ufffd\u0551\ufffdX\ufffd\ufffd\ufffdEVp\ufffd\ufffdop\ufffdW\n\ufffd!z^\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "14301 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14301" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 14286, 14301, 14303, 14415, 14557 ], "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 22, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan" ], "correlation_confidence_boost": 16, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:27:42 UTC	TCP	14473 · TLS	tls	Scan de ports port scan syn · via TLS:14473 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14473 Chemin / cible — Service TLS Payload ��`a4m?T��BmHze�Z�G��n��^��I��- 0w��:�4<�E��B3Qq� 3$�-w�E@&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +16 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��`a4m?T��BmHze�Z�G��n��^��I��- 0w��:�4<�E��B3Qq� 3$�-w�E@&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��`a4m?T��BmHze�Z�G��n��^��I��- 0w��:�4<�E��B3Qq� 3$�-w�E@&̨̩�/�0�+�,�� /5� { �+ 3&$ �<��JY��u[�F�BJgQ��R�,��w�8% Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.735739303749453, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 14473, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b22f8caf11e79c4d3b552e7bc0b0b6ead7bbfbf3", "event_fingerprint": "228eb6c863efcb8d54ba2ad2641825d2dd57f176", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 16 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "e940ed8bcb28b087795fcb8b031723cf", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 14473, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd-\u0014 \u00180\u001dw\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\u0013\ufffd\n3\u0017$\ufffd-\u0014w\u0000\ufffdE@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd-\u0014 \u00180\u001dw\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\u0013\ufffd\n3\u0017$\ufffd-\u0014w\u0000\ufffdE@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0017<\ufffd\ufffdJY\ufffd\ufffd\u0001u[\ufffdF\ufffdBJgQ\ufffd\ufffdR\ufffd,\ufffd\u0017\ufffdw\ufffd8\u0018%", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd-\u0014 \u00180\u001dw\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\u0013\ufffd\n3\u0017$\ufffd-\u0014w\u0000\ufffdE@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "793b462fd1bd60fe2876d2dabf965fd656e41ef3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd-\u0014 \u00180\u001dw\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\u0013\ufffd\n3\u0017$\ufffd-\u0014w\u0000\ufffdE@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14473, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd- 0w\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\ufffd\n3$\ufffd-w\ufffdE@&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "port scan syn \u00b7 via TLS:14473 \u00b7 (reconnaissance)", "target_port_label": "14473 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 16 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14473, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +16", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd-\u0014 \u00180\u001dw\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\u0013\ufffd\n3\u0017$\ufffd-\u0014w\u0000\ufffdE@\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14473, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:14473 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd`a4m?T\ufffd\ufffdBmHze\ufffdZ\ufffdG\ufffd\ufffdn\ufffd\ufffd^\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd- 0w\ufffd\ufffd:\ufffd4<\ufffdE\ufffd\ufffdB3Qq\ufffd\n3$\ufffd-w\ufffdE@&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "14473 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14473" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 14286, 14301, 14303, 14415, 14473, 14557 ], "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 21, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan" ], "correlation_confidence_boost": 16, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:27:37 UTC	TCP	14557 · TLS	tls	Scan de ports port scan syn · via TLS:14557 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14557 Chemin / cible — Service TLS Payload ��R�e�S�h��J~��w ��.���VLn%9 F/��0y�C��W�e8�"��}�B�4�_� �&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��R�e�S�h��J~��w ��.���VLn%9 F/��0y�C��W�e8�"��}�B�4�_� �&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��R�e�S�h��J~��w ��.���VLn%9 F/��0y�C��W�e8�"��}�B�4�_� �&̨̩�/�0�+�,�� /5� { �+ 3&$ �B�H�(�s_�n��]�dE��Cj�n�Tj Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.79142212989758, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 14557, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "33ac20ce74828e96c9b970724310b5927ee7f95e", "event_fingerprint": "7119c48a2fe8067e5d705d3f57d87da507cc1c65", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "9167e59d8434afec76a1c59d88bb1323", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 14557, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd\u00160y\ufffdC\ufffd\ufffd\ufffdW\ufffd\u0000e8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd\u00160y\ufffdC\ufffd\ufffd\ufffdW\ufffd\u0000e8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdB\ufffd\u0000H\ufffd(\u0006\ufffds_\ufffdn\ufffd\ufffd]\ufffd\u0018dE\ufffd\ufffdCj\ufffdn\ufffdTj", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd\u00160y\ufffdC\ufffd\ufffd\ufffdW\ufffd\u0000e8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "741e35f4669e8e49d01ff9d5cf218a70e5ac6807", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd\u00160y\ufffdC\ufffd\ufffd\ufffdW\ufffd\u0000e8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14557, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdR\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd0y\ufffdC\ufffd\ufffd\ufffdW\ufffde8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "port scan syn \u00b7 via TLS:14557 \u00b7 (reconnaissance)", "target_port_label": "14557 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14557, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd\u00160y\ufffdC\ufffd\ufffd\ufffdW\ufffd\u0000e8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14557, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:14557 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffdR\ufffde\ufffdS\ufffdh\ufffd\ufffdJ~\ufffd\ufffdw\n\ufffd\ufffd\ufffd\ufffd.\ufffd\uf769\ufffd\ufffdVLn%9 F\/\ufffd\ufffd0y\ufffdC\ufffd\ufffd\ufffdW\ufffde8\ufffd\"\ufffd\ufffd}\ufffdB\ufffd4\ufffd_\ufffd\n\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "14557 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14557" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 14286, 14303, 14415, 14557 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.36, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 22, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:27:36 UTC	TCP	14415 · TLS	tls	Scan de ports port scan syn · via TLS:14415 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Scan coordonné MITRE T1046 TA0043 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14415 Chemin / cible — Service TLS Payload ��dS��_/:��y�9{T�:�E^�� u�"�(�D�ۙ7n�Ւ�S�h��p� �&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��dS��_/:��y�9{T�:�E^�� u�"�(�D�ۙ7n�Ւ�S�h��p��&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��dS��_/:��y�9{T�:�E^�� u�"�(�D�ۙ7n�Ւ�S�h��p� �&̨̩�/�0�+�,�� /5� { �+ 3&$ z�. �;�k�4.Yw�qL]��Ct�d�0GJ* Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.880210453781298, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 14415, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7a8a24ec1f7ead408a84576ec9901bfc87880c38", "event_fingerprint": "80e8cac3bd41e5edde16dda497ff7f4b1142222c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "1d5b412f01d744caa3bed36eb2f08f15", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 14415, "service": "tls", "service_name": "tls", "risk_score": 42 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0007\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffd\u001by\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\u0000\ufffdD\u001c\u0019\ufffd\u06d97n\ufffd\u0552\u0017\u0012\ufffd\u0004S\ufffdh\ufffd\ufffdp\ufffd\u000b\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0007\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffd\u001by\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\u0000\ufffdD\u001c\u0019\ufffd\u06d97n\ufffd\u0552\u0017\u0012\ufffd\u0004S\ufffdh\ufffd\ufffdp\ufffd\u000b\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 z\ufffd.\u000b\ufffd;\ufffdk\ufffd4.Y\u0004\u0018w\ufffdqL]\ufffd\ufffd\ufffd\ufffdCt\ufffdd\ufffd0GJ*", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0007\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffd\u001by\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\u0000\ufffdD\u001c\u0019\ufffd\u06d97n\ufffd\u0552\u0017\u0012\ufffd\u0004S\ufffdh\ufffd\ufffdp\ufffd\u000b\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7932b9a638fa139188455e6e29ea794e40528b39", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0007\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffd\u001by\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\u0000\ufffdD\u001c\u0019\ufffd\u06d97n\ufffd\u0552\u0017\u0012\ufffd\u0004S\ufffdh\ufffd\ufffdp\ufffd\u000b\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14415, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\ufffdD\ufffd\u06d97n\ufffd\u0552\ufffdS\ufffdh\ufffd\ufffdp\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "port scan syn \u00b7 via TLS:14415 \u00b7 (reconnaissance)", "target_port_label": "14415 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14415, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_rapide", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0007\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffd\u001by\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\u0000\ufffdD\u001c\u0019\ufffd\u06d97n\ufffd\u0552\u0017\u0012\ufffd\u0004S\ufffdh\ufffd\ufffdp\ufffd\u000b\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14415, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "port scan syn \u00b7 via TLS:14415 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddS\ufffd\ufffd\ufffd_\/:\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd9{T\ufffd:\ufffdE^\ufffd\ufffd \ufffdu\ufffd\"\ufffd(\ufffdD\ufffd\u06d97n\ufffd\u0552\ufffdS\ufffdh\ufffd\ufffdp\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "14415 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14415" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 1.69, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 22, "behavior_alerts": [ "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 15:27:34 UTC	TCP	14286 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:14286 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14286 Chemin / cible — Service TLS Payload ��o�df��uq�_��:�J�t.#�v,� g��#V�K^$O��T��!չ㛈&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��o�df��uq�_��:�J�t.#�v,� g��#V�K^$O��T��!չ㛈&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��o�df��uq�_��:�J�t.#�v,� g��#V�K^$O��T��!չ㛈&̨̩�/�0�+�,�� /5� { �+ 3&$ $1Bc��.h��zbz_l�)��)6��.:�_ Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.800323170608426, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 14286, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f892dd8191e566ac72de9cd0d7e3f78af9e9847a", "event_fingerprint": "b8ca051a1e5f6f603582468e79e92ef37a926f59", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "2fef5f520f4ee3748696e79dbd74b634", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 14286, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\u0011\u0018df\ufffd\ufffduq\u0005\ufffd_\ufffd\ufffd\u0019\ufffd\ufffd:\ufffdJ\ufffdt\u001e\u001e.#\ufffdv\u0002,\ufffd g\ufffd\ufffd\u0004#V\ufffdK^\ue234$\u0018O\u000f\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8\u0014\u0006\u001f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\u0011\u0018df\ufffd\ufffduq\u0005\ufffd_\ufffd\ufffd\u0019\ufffd\ufffd:\ufffdJ\ufffdt\u001e\u001e.#\ufffdv\u0002,\ufffd g\ufffd\ufffd\u0004#V\ufffdK^\ue234$\u0018O\u000f\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8\u0014\u0006\u001f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 $1Bc\ufffd\ufffd.h\ufffd\ufffd\ufffd\u001ezbz_l\ufffd)\ufffd\ufffd\ufffd\u0013)\u00196\ufffd\ufffd.:\ufffd_", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\u0011\u0018df\ufffd\ufffduq\u0005\ufffd_\ufffd\ufffd\u0019\ufffd\ufffd:\ufffdJ\ufffdt\u001e\u001e.#\ufffdv\u0002,\ufffd g\ufffd\ufffd\u0004#V\ufffdK^\ue234$\u0018O\u000f\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8\u0014\u0006\u001f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "73e33c7db45f28702f4afee6b76e44b597d82f43", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\u0011\u0018df\ufffd\ufffduq\u0005\ufffd_\ufffd\ufffd\u0019\ufffd\ufffd:\ufffdJ\ufffdt\u001e\u001e.#\ufffdv\u0002,\ufffd g\ufffd\ufffd\u0004#V\ufffdK^\ue234$\u0018O\u000f\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8\u0014\u0006\u001f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14286, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdo\ufffddf\ufffd\ufffduq\ufffd_\ufffd\ufffd\ufffd\ufffd:\ufffdJ\ufffdt.#\ufffdv,\ufffd g\ufffd\ufffd#V\ufffdK^\ue234$O\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:14286 \u00b7 (sonde \/ probe)", "target_port_label": "14286 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14286, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffd\u0011\u0018df\ufffd\ufffduq\u0005\ufffd_\ufffd\ufffd\u0019\ufffd\ufffd:\ufffdJ\ufffdt\u001e\u001e.#\ufffdv\u0002,\ufffd g\ufffd\ufffd\u0004#V\ufffdK^\ue234$\u0018O\u000f\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8\u0014\u0006\u001f\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14286, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:14286 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdo\ufffddf\ufffd\ufffduq\ufffd_\ufffd\ufffd\ufffd\ufffd:\ufffdJ\ufffdt.#\ufffdv,\ufffd g\ufffd\ufffd#V\ufffdK^\ue234$O\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd!\u0579\u36c8&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "14286 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14286" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 21, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ], "behavior_alert_count": 1, "behavior_priority": 72 }
12/07/2026 15:27:34 UTC	TCP	14303 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:14303 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 35fa0a83e466acbe Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14303 Chemin / cible — Service TLS Payload ��p��F�#/O�kq�ޘ��#��(ߋ�� ɼ\|q�� 1=��{�5�{��⋕��4:ٮU&̨̩�/�0�+�,�� /5� { Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��p��F�#/O�kq�ޘ��#��(ߋ�� ɼ\|q��1=��{�5�{��⋕��4:ٮU&̨̩�/�0�+�,�� /5� { Requête brute (extrait) ��p��F�#/O�kq�ޘ��#��(ߋ�� ɼ\|q�� 1=��{�5�{��⋕��4:ٮU&̨̩�/�0�+�,�� /5� { �+ 3&$ M�X�fC�^ńE��.8�C�v��}t��:1p Meta JSON brut { "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 4, "bytes_in": 243, "payload_entropy": 5.84265003531201, "port_category": "registered", "org": "Modat B.V.", "service": "tls", "app_proto": "tls", "asn": 209334, "country": "CA", "dst_port": 14303, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3033e30d75fb38ec3f5ca8522a03f0a1cc72ed80", "event_fingerprint": "714f468d6dc68ee1b7f4b7a9ab97060682999a7f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "35fa0a83e466acbec1cfbb9016d550ab", "payload_hash": "3a362b6b2cfefe030a1fed63f9ced11a", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja4": "7b5e3a15097abc10f88e98257ea51010", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010", "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 19, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 14303, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003p\ufffd\u0000\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\u0000\ufffd\ufffd\u0007\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd\u000f \u027c\|\u001eq\ufffd\ufffd\f1=\ufffd\ufffd{\ufffd\u00125\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4\u001a:\u066eU\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003p\ufffd\u0000\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\u0000\ufffd\ufffd\u0007\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd\u000f \u027c\|\u001eq\ufffd\ufffd\f1=\ufffd\ufffd{\ufffd\u00125\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4\u001a:\u066eU\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 M\ufffdX\ufffdfC\ufffd^\u0144\u0013E\ufffd\ufffd.8\ufffdC\u0011\ufffdv\ufffd\ufffd}t\ufffd\ufffd:1\bp", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003p\ufffd\u0000\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\u0000\ufffd\ufffd\u0007\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd\u000f \u027c\|\u001eq\ufffd\ufffd\f1=\ufffd\ufffd{\ufffd\u00125\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4\u001a:\u066eU\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0e141c0545ade0586874a34f5ef5319a51cb40f7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003p\ufffd\u0000\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\u0000\ufffd\ufffd\u0007\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd\u000f \u027c\|\u001eq\ufffd\ufffd\f1=\ufffd\ufffd{\ufffd\u00125\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4\u001a:\u066eU\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14303, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdp\ufffd\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd \u027c\|q\ufffd\ufffd1=\ufffd\ufffd{\ufffd5\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4:\u066eU&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "attack_vector": "postgres probe \u00b7 via TLS:14303 \u00b7 (sonde \/ probe)", "target_port_label": "14303 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 14303, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003p\ufffd\u0000\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\u0000\ufffd\ufffd\u0007\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd\u000f \u027c\|\u001eq\ufffd\ufffd\f1=\ufffd\ufffd{\ufffd\u00125\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4\u001a:\u066eU\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab", "tls_ja4": "7b5e3a15097abc10f88e98257ea51010", "port": 14303, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:14303 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdp\ufffd\ufffd\ufffdF\ufffd#\/O\ufffdkq\ufffd\u0798\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffd(\u07cb\ufffd\ufffd\ufffd \u027c\|q\ufffd\ufffd1=\ufffd\ufffd{\ufffd5\ufffd{\ufffd\ufffd\u22d5\ufffd\ufffd4:\u066eU&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{", "target_port_label": "14303 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "14303" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 21, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/07/2026 14:39:05 UTC	TCP	2929 · HTTP	http	Scan de ports port scan syn · via HTTP:2929 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2929 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2929 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2929 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "629185b7206327033c556f40c20188b1de02fe9f", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 2929, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "48a945aef69e6956b7aae016767ccfb027592cd3", "event_fingerprint": "33181e7a515e9aec388fdf3e3ee0dada501cc10a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "d67afd93674ecd85a4f338147be82ed1", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2929, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a0b7f3eec911b338bd8111336d20c78647111697", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2929, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:2929 \u00b7 (reconnaissance)", "target_port_label": "2929 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2929, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2929, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:2929 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2929\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "2929 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2929" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 2758, 2893, 2929, 3114, 7816, 8471 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.08, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:39:05 UTC	TCP	2947 · HTTP	http	Scan de ports port scan syn · via HTTP:2947 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2947 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2947 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2947 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "0ad24987a79329ab0ab17f00842ada151b617719", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.209775079139071, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 2947, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "63145b8ceb427b4020eae9ded989d3dbc960ce08", "event_fingerprint": "5190ac3220878d8c8196f3f12340d03126d122f9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "338ceb67099af7407532e9845509eb18", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2947, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "367e19e9a34fe78d276786b1b56d07f64b6597c3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2947, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:2947 \u00b7 (reconnaissance)", "target_port_label": "2947 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2947, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2947, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:2947 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2947\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "2947 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2947" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 2758, 2893, 2929, 2947, 3114, 7816, 8471 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.24, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:39:04 UTC	TCP	2758 · HTTP	http	Scan de ports port scan syn · via HTTP:2758 · (reconnaissance)	Élevée	Moyen · 61
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2758 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 61 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2758 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2758 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "e27e8fdda607e3fb7c623d6f2697e5d0d839b5ca", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.1917692784713365, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 2758, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 61, "tag_count": 5, "anomaly_count": 0, "campaign_key": "997a567cb3a301cb0c72b8bbfb95f5fe4adef7bd", "event_fingerprint": "542b84b0df0779b7a3dd8c2f3b2d71e5b9613783", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 61, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "70df8b9a3ab7489b85b9f6ffbcc9e428", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2758, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5649f179357d37b4141d00a78d03a27c1b6ccee", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2758, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:2758 \u00b7 (reconnaissance)", "target_port_label": "2758 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 61, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2758, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2758, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:2758 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2758\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "2758 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2758" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 2758, 2893, 3114, 7816, 8471 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.05, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:39:03 UTC	TCP	3114 · HTTP	http	Scan de ports port scan syn · via HTTP:3114 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3114 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3114 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3114 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "33b4fca36941ebb3cbf76924f31b0772b6eb4f60", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.161768687191709, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 3114, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e23093b94bcc5b5de259060e1a7e18d30f8e8240", "event_fingerprint": "06f4cf8e0599fd5949e2e11b49ea01affb314158", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "6ac78eb5081e9b7eb30c7662b74cddee", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3114, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e338dae4f18c8919e57306a8760a872926767b50", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 3114, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:3114 \u00b7 (reconnaissance)", "target_port_label": "3114 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3114, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 3114, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3114 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3114\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "3114 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3114" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 2893, 3114, 7816, 8471 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 1.01, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 72 }
12/07/2026 14:39:02 UTC	TCP	2893 · HTTP	http	Scan de ports port scan syn · via HTTP:2893 · (reconnaissance)	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2893 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2893 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2893 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "80a1d8a45de32031c670341a100ecbe82c1c7985", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 2893, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 58, "tag_count": 5, "anomaly_count": 0, "campaign_key": "b7454a1c9e1553cc8ebbd91bce373416436b730f", "event_fingerprint": "5eb94e1a10d300885a9ce9d75739a32c7c2c649f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 58, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "3b7377f57b445705b1818079815fb4de", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2893, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "19c16687d72d150f2888054c3fb5b94f7e4e28dd", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2893, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:2893 \u00b7 (reconnaissance)", "target_port_label": "2893 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 58, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2893, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 2893, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:2893 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2893\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "2893 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2893" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 1.06, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 6, "behavior_alerts": [ "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:39:00 UTC	TCP	7816 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7816 · (tentative d'exploit)	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7816 Chemin / cible / Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 69% Corrélation +10 Risque capteur Moyen · 55 Confiance : Confiance 59 % — 5 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7816 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7816 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "701f33dc89203097e6fc4d71edd2ade183b15e8c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.193499098775195, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 7816, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 55, "tag_count": 5, "anomaly_count": 0, "campaign_key": "d9b89b24252988113274efcca7c5f0c88a067cc7", "event_fingerprint": "a3eb5fd0a6f512d3722e65b10e871740990fc70a", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.69, "classification_confidence": 0.69, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 55, "correlation_boost": 10 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "f5fee42fc31123433b1da856ee82507e", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7816, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "520e0e70c2f28cd4159df225c3a323ca4283943f", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 7816, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "lfi path traversal \u00b7 via HTTP:7816 \u00b7 (tentative d'exploit)", "target_port_label": "7816 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 69, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 55, "correlation_boost": 10 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7816, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 7816, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7816 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "7816 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7816" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 6, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:38:59 UTC	TCP	8471 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:8471 · (tentative d'exploit)	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8471 Chemin / cible / Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 69% Corrélation +10 Risque capteur Moyen · 56 Confiance : Confiance 59 % — 5 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8471 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8471 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "001ecb498bc97f9520f3b7ce752c03384bbd613b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.206570994200032, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 8471, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 56, "tag_count": 5, "anomaly_count": 0, "campaign_key": "56b57db3b73ac985b58fabef03f85dd5eb6db611", "event_fingerprint": "67af52dd0bdd193f7e326438dec0d35813ae347f", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.69, "classification_confidence": 0.69, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 56, "correlation_boost": 10 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "d0323af94cfa7c1770416b9d2cdc6e27", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8471, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c7dcab9cdab3129c21f854ac3e52b6ea0c53c2f", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 8471, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "lfi path traversal \u00b7 via HTTP:8471 \u00b7 (tentative d'exploit)", "target_port_label": "8471 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 69, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 56, "correlation_boost": 10 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8471, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 8471, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:8471 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "8471 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8471" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 6, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 72 }
12/07/2026 14:32:04 UTC	TCP	6468 · HTTP	http	Scan de ports port scan syn · via HTTP:6468 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6468 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6468 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6468 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "dc8c5a98d5b87d2bb92aeb1b0a67794eae83ebb1", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.196703183714235, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6468, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c707cfa1134ed3eba18a0b10541e7273d0b9afd7", "event_fingerprint": "bd22689d6391598525e765eb9b4ef1f7488ca275", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "bc63b9db0f890a78eb3afb2b628def03", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6468, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cde6a468b2da13164646bda223179133a0090050", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6468, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6468 \u00b7 (reconnaissance)", "target_port_label": "6468 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6468, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6468, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6468 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6468\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6468 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6468" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 24, "port_scan_ports_sample": [ 1471, 1644, 1735, 1839, 1876, 1879, 1902, 5816, 5973, 5995, 5997, 6000, 6139, 6161, 6197, 6205 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 24, "scan_velocity_ports_per_s": 7.19, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:04 UTC	TCP	1674 · HTTP	http	Scan de ports port scan syn · via HTTP:1674 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1674 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1674 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1674 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "f24655fc79cae9fcade2fc34f5a03a3318438334", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.193499098775195, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1674, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 0, "campaign_key": "5564868fe5219a1364c89113498d4493c0c074ff", "event_fingerprint": "63daaea999cf8782ad9bcc3e0f1d0fb8be4f471e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "f1b856443e2698120db1bde58f91474c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1674, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1252c5be6edc0be198fb479d1c66c7105a8f01b1", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1674, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1674 \u00b7 (reconnaissance)", "target_port_label": "1674 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1674, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1674, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1674 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1674\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1674 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1674" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 1471, 1644, 1674, 1735, 1839, 1876, 1879, 1902, 5816, 5973, 5995, 5997, 6000, 6139, 6161, 6197 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 25, "scan_velocity_ports_per_s": 7.3, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:04 UTC	TCP	1617 · HTTP	http	Scan de ports port scan syn · via HTTP:1617 · (reconnaissance)	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1617 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1617 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1617 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "34d37ecd7360e02184af0598c21619d0d9e30fdb", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.169906677373648, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1617, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 58, "tag_count": 6, "anomaly_count": 0, "campaign_key": "8b5347877611c7ecf64cf6bbb823d2910da3516c", "event_fingerprint": "05baf01579b55bcd1ca9aa698cdf4d686275d2c7", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 58, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "3286b84b5d653912437bbfacc91b0343", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1617, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b5575df1db27970b81be5e3dd8b30f82d8db2d9", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1617, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1617 \u00b7 (reconnaissance)", "target_port_label": "1617 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 58, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1617, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1617, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1617 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1617\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1617 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1617" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 26, "port_scan_ports_sample": [ 1471, 1617, 1644, 1674, 1735, 1839, 1876, 1879, 1902, 5816, 5973, 5995, 5997, 6000, 6139, 6161 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 26, "scan_velocity_ports_per_s": 7.58, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:03 UTC	TCP	1839 · HTTP	http	Scan de ports port scan syn · via HTTP:1839 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1839 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1839 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1839 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "3e022ef94f0a007c823c1a746e60bb78ca87cae4", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.1853611085932565, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1839, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 6, "anomaly_count": 0, "campaign_key": "14c7288469aa56ef3de795f9b6e6911fe9faffd9", "event_fingerprint": "c94a73e1529167ee9e02c04582075095e9c06e76", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "fd136d24b96589ea101d9a8f9faa7ae4", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1839, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d688d5c09f0d6689ed5447fdc9d469c15da3f3d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1839, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1839 \u00b7 (reconnaissance)", "target_port_label": "1839 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1839, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1839, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1839 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1839 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1839" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 19, "port_scan_ports_sample": [ 1471, 1644, 1735, 1839, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6345, 6393 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 19, "scan_velocity_ports_per_s": 8.05, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:03 UTC	TCP	6284 · HTTP	http	Scan de ports port scan syn · via HTTP:6284 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6284 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6284 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6284 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "a054aab1568dfd21133660c997dcfc9e043cebf6", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.196703183714235, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6284, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "bf17bed3dbdc4693e372220518329bdea320cb99", "event_fingerprint": "252d726d36a7d8c3f9adf632c113c2fd6618b7b6", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "d214f6270d452e9325e3746bd6b868d6", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6284, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0d403bdae476a44843f718bef4ca71d0d697b46a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6284, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6284 \u00b7 (reconnaissance)", "target_port_label": "6284 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6284, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6284, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6284 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6284\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6284 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6284" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 20, "port_scan_ports_sample": [ 1471, 1644, 1735, 1839, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6284, 6345 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 20, "scan_velocity_ports_per_s": 8.23, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:03 UTC	TCP	6205 · HTTP	http	Scan de ports port scan syn · via HTTP:6205 · (reconnaissance)	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6205 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6205 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6205 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "d14eb16cf913808dd3208d97ef874140fa900137", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.160691582378766, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6205, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 58, "tag_count": 6, "anomaly_count": 0, "campaign_key": "433b5ff4770365813a25de776536ba5d91483c69", "event_fingerprint": "6d253c69fd99abc2b5bb6ffcaa9fa595bae366d8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 58, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "1b2dac5d272e68fe7edd9c9ea7b36ec8", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6205, "service": "http", "service_name": "http", "risk_score": 58 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b94457a8339a920d81fc3fd5b84adf001401f1ff", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6205, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6205 \u00b7 (reconnaissance)", "target_port_label": "6205 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 58, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 58, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6205, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6205, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6205 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6205\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6205 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6205" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 21, "port_scan_ports_sample": [ 1471, 1644, 1735, 1839, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6205, 6262, 6284 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 21, "scan_velocity_ports_per_s": 8.19, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:03 UTC	TCP	6139 · HTTP	http	Scan de ports port scan syn · via HTTP:6139 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6139 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6139 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6139 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "f14f1fdae044bda8ad8f311a119ccf037086175a", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.172289213168421, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6139, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 0, "campaign_key": "d10acdaa87d7d1e48a992da6f58806bb29a1551d", "event_fingerprint": "73c3216bb167dff388ac05fd45cd34e4b9fff827", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "1089226bd5baf90aac8c27aef0b8293b", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6139, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cb62e4c7ea435c2fdb3748e30190516577918f7c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6139, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6139 \u00b7 (reconnaissance)", "target_port_label": "6139 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6139, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6139, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6139 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6139\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6139 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6139" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 22, "port_scan_ports_sample": [ 1471, 1644, 1735, 1839, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6139, 6161, 6197, 6205, 6262 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 22, "scan_velocity_ports_per_s": 7.58, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:03 UTC	TCP	1902 · HTTP	http	Scan de ports port scan syn · via HTTP:1902 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1902 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1902 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1902 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "13bee387ce74c9047557c5e06edfddeaa1ddc6a9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.170559392864562, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1902, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 6, "anomaly_count": 0, "campaign_key": "178ac0067c1714d6bb1d35600793df95791de5ce", "event_fingerprint": "b199d43dc42b40246f0809a0f7fbcb4021be39f3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "ebceedd9042ec9197c5f7bdf19af7298", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1902, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e8e6b3ac19dbc82e6a404efb9a397086abb46943", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1902, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1902 \u00b7 (reconnaissance)", "target_port_label": "1902 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1902, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1902, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1902 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1902\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1902 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1902" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 23, "port_scan_ports_sample": [ 1471, 1644, 1735, 1839, 1876, 1879, 1902, 5816, 5973, 5995, 5997, 6000, 6139, 6161, 6197, 6205 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 23, "scan_velocity_ports_per_s": 7.36, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	5973 · HTTP	http	Scan de ports port scan syn · via HTTP:5973 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5973 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5973 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5973 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "69922cd966210a72545c8392f3d7e08ffa56d325", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 5973, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "a343292ab3371a52d89a7a9ab6ef33cf322c7ab5", "event_fingerprint": "790c9a97c78b8c2f9cf2728a17a492495620ee38", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "55af6897e9b14047123efa050592d088", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5973, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc74e904e7dbd0ba92235cdd69ce36477111f843", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5973, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:5973 \u00b7 (reconnaissance)", "target_port_label": "5973 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5973, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5973, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5973 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5973\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "5973 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5973" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 1876, 1879, 5816, 5973, 5995, 6161, 6197, 6262, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 8.41, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	6000 · HTTP	http	Scan de ports port scan syn · via HTTP:6000 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6000 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6000 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "9d347d028c377ce68c7f996bd692f8cf5d190493", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.151900876705914, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6000, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "ea32f4bb97f175435ced9c0d50883c4b8f9dc0d8", "event_fingerprint": "e9c38b73210d3d6e94135f115d7fd5cc3cb6fb35", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "baacd6059f870685eaf3768da5c33fbe", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6000, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "36d84fa12bce413f2eb88044cf19834c780b65bc", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6000 \u00b7 (reconnaissance)", "target_port_label": "6000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6000, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6000 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6000\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 1876, 1879, 5816, 5973, 5995, 6000, 6161, 6197, 6262, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 13, "scan_velocity_ports_per_s": 9.06, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	5997 · HTTP	http	Scan de ports port scan syn · via HTTP:5997 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5997 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5997 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5997 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "49a5ab68cbaf167b4e89ff15f13e9ceca8b3f742", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.196703183714235, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 5997, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 6, "anomaly_count": 0, "campaign_key": "e0a6478d4de57937ce8448aeea159c30639a1a28", "event_fingerprint": "e370c688ca0e536c19e13695e37f3a8bf3eb89b0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "81a8954861605841943d58644e15cf96", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5997, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cb4a97b33c65e7aa5a51ea580d550bd0bd8f31e0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5997, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:5997 \u00b7 (reconnaissance)", "target_port_label": "5997 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5997, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5997, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5997 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5997\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "5997 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5997" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 14, "scan_velocity_ports_per_s": 9.33, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	1735 · HTTP	http	Scan de ports port scan syn · via HTTP:1735 · (reconnaissance)	Élevée	Moyen · 62
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1735 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 62 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1735 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1735 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "63aa63b29163f4161110034c6eef2f83ca14e847", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.167355307925522, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1735, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.9, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 62, "tag_count": 6, "anomaly_count": 0, "campaign_key": "471c8cc99001b90ceeae6cc82148c6affa173584", "event_fingerprint": "2b3bd7d0d4691e29329f68b3d6d1a87eb01945ce", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 62, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "b2f0126f07adf9baa66d0115b89bf3b6", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1735, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c5e56c0dac3f711df363e368c6032a1d42360aff", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1735, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1735 \u00b7 (reconnaissance)", "target_port_label": "1735 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 62, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1735, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1735, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1735 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1735\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1735 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1735" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 15, "port_scan_ports_sample": [ 1735, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 15, "scan_velocity_ports_per_s": 9.12, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	6345 · HTTP	http	Scan de ports port scan syn · via HTTP:6345 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6345 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6345 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6345 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "ddb4d3920993f6f69d5186ff09f3efd82058390f", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6345, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 6, "anomaly_count": 0, "campaign_key": "33806e15dd7a6357984444b0f65cb470a2d1740a", "event_fingerprint": "4fd5d56ec96342395858164c043cfa93aa481064", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "c5f47a05fa98832402fabd94a68c9be6", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6345, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2c7586fa08eb31cdbd2e4cf167fc75b55f47960", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6345, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6345 \u00b7 (reconnaissance)", "target_port_label": "6345 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6345, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6345, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6345 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6345\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6345 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6345" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 16, "port_scan_ports_sample": [ 1735, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6345, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 16, "scan_velocity_ports_per_s": 9.05, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	1471 · HTTP	http	Scan de ports port scan syn · via HTTP:1471 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1471 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1471 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1471 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "529e31a9b0f9a3abd690f622d6bf2fab1a7217e1", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.182978572798484, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1471, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 6, "anomaly_count": 0, "campaign_key": "afde24dfd5d3fdbee7c5edd912ebe4d804f8c4ef", "event_fingerprint": "387ef63adcc780c7d494a4187eb8696bb3e9a2b9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "6d818c30ca31c9063ec92a00149d7391", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1471, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "210ea82dc3a70e9580f95ffbfeb01c953352f0ef", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1471, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1471 \u00b7 (reconnaissance)", "target_port_label": "1471 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1471, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1471, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1471 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1471 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1471" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 17, "port_scan_ports_sample": [ 1471, 1735, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6345, 6393, 6423, 6435 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 17, "scan_velocity_ports_per_s": 9.56, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:02 UTC	TCP	1644 · HTTP	http	Scan de ports port scan syn · via HTTP:1644 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1644 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1644 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1644 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "eb7e15b02314a7be829296d117740dc93e4289b0", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.1804272033503596, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1644, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 0, "campaign_key": "e9d1d919fde09a41a856388f1c13d3817eeb85bb", "event_fingerprint": "53705369a7b005ab55a73c387bb14f418a28c051", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "ae35d42b41c08b7981190cbe14d0bcff", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1644, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7535895dad7ef554497c409191dcac54039dc5fe", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1644, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1644 \u00b7 (reconnaissance)", "target_port_label": "1644 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1644, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1644, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1644 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1644\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1644 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1644" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 18, "port_scan_ports_sample": [ 1471, 1644, 1735, 1876, 1879, 5816, 5973, 5995, 5997, 6000, 6161, 6197, 6262, 6345, 6393, 6423 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 18, "scan_velocity_ports_per_s": 10.07, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_fast" ] }
12/07/2026 14:32:01 UTC	TCP	6533 · HTTP	http	Scan de ports port scan syn · via HTTP:6533 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6533 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6533 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6533 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "e6e427ec057d69967c25043609993e59e36095d9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.151900876705914, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6533, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "3c9147e6e4e78c6f8ae8aa812002f38a9e661406", "event_fingerprint": "f95cc429c8ef9296fdf0feedc9ef7cef32ffe69c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "6d21328f49d1f0b64978df12fad52e51", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6533, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c647af3457167d72fd20aea364520337e82b4be3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6533, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6533 \u00b7 (reconnaissance)", "target_port_label": "6533 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 60, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6533, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6533, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6533 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6533\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6533 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6533" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 5995, 6161, 6197, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 5.92, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:01 UTC	TCP	1879 · HTTP	http	Scan de ports port scan syn · via HTTP:1879 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1879 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1879 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1879 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "89828c04c696a7daac945d826f543947001d7555", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.206570994200032, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1879, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5dd8d2b643c69c065907e1ca2f23ed6b3163ba9f", "event_fingerprint": "750fae6786ac72db3260ad20941834438dc814d6", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "316087dea8a52fbe506ffc8762a3a8ae", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1879, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "33d50e2942205dba6ef13c1af6eae136a50314ab", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1879, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1879 \u00b7 (reconnaissance)", "target_port_label": "1879 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1879, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1879, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1879 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1879\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1879 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1879" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 1879, 5995, 6161, 6197, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 6.76, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:01 UTC	TCP	6393 · HTTP	http	Scan de ports port scan syn · via HTTP:6393 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6393 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6393 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6393 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "80f76865163947052a83268844cde788170b0e90", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.169906677373648, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6393, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "b8925ece5a8514703aaa99f2478bf089fe2831d3", "event_fingerprint": "1b6cd7d8d60682f5fa1accd3641a0c28548076a0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "20dae037279066877a075dc33250463a", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6393, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1d35c7e20b7e9ef37e04312987490027c3a8458a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6393, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6393 \u00b7 (reconnaissance)", "target_port_label": "6393 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6393, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6393, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6393 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6393\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6393 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6393" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 1879, 5995, 6161, 6197, 6393, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 7.83, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:01 UTC	TCP	6423 · HTTP	http	Scan de ports port scan syn · via HTTP:6423 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6423 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6423 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6423 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "95fb93fdad6343e7f8de7842bafa1c14769442e4", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6423, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "207c0e69764d0b802a045c5ed8e69a31d549abdd", "event_fingerprint": "53a887bf837ca34bf83195efcf4955da83a37164", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "446544f97d128d40bb7d64789c0e9843", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6423, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49394f8f05efb5ffacac80454d8c567baaa153d6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6423, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6423 \u00b7 (reconnaissance)", "target_port_label": "6423 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6423, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6423, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6423 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6423\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6423 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6423" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 1879, 5995, 6161, 6197, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 7.78, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:01 UTC	TCP	1876 · HTTP	http	Scan de ports port scan syn · via HTTP:1876 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1876 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1876 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1876 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "5b04ad6182e9bd6f6881ba544409655097149903", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.193499098775195, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1876, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "39bbe50f49877cffcbe55cf964d6ffcfeb1740db", "event_fingerprint": "5f8258734627355d64fb6890c336d7992f0c0d54", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "b5e9681cf197b902ebbab1acabd6c795", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1876, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f02a3583f805f0f84adb122175defc663e819085", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1876, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1876 \u00b7 (reconnaissance)", "target_port_label": "1876 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1876, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1876, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1876 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1876\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1876 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1876" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 1876, 1879, 5995, 6161, 6197, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 8.64, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:01 UTC	TCP	6262 · HTTP	http	Scan de ports port scan syn · via HTTP:6262 · (reconnaissance)	Élevée	Moyen · 56
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6262 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 56 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6262 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6262 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "1b52c26b3fcc0edb0b75147e542fb51b91042577", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.157487497439726, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6262, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 56, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fd037998dc67f52c996b3343c5aa4addae8c7dd9", "event_fingerprint": "61cb050ab474cb5b217e0ce7a4a3e26e750b8b62", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 56, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "d7ee2d2c95723178328e95e105582c8e", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6262, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ddb833fe97cfe0252fc44d777941204fc2736c4c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6262, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6262 \u00b7 (reconnaissance)", "target_port_label": "6262 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 56, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6262, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6262, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6262 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6262\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6262 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6262" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 10, "port_scan_ports_sample": [ 1876, 1879, 5995, 6161, 6197, 6262, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 10, "scan_velocity_ports_per_s": 9.04, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:01 UTC	TCP	5816 · HTTP	http	Scan de ports port scan syn · via HTTP:5816 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5816 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5816 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5816 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "e3e670002c715b9f160de7caba9d7b733d94f2a9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.175493298107461, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 5816, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f32c5830631f91de20c41c8c4892df52845e6a62", "event_fingerprint": "76eb0cf374ae6c3f4d43f1b775281481ec91e3d4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "d289b85555ae59107948e783d2b1f88c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5816, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f79fdc9a66fc0c996c95db8202722dc353929fea", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5816, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:5816 \u00b7 (reconnaissance)", "target_port_label": "5816 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5816, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5816, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5816 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5816\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "5816 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5816" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 11, "port_scan_ports_sample": [ 1876, 1879, 5816, 5995, 6161, 6197, 6262, 6393, 6423, 6435, 6533 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 11, "scan_velocity_ports_per_s": 8.4, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:00 UTC	TCP	6197 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:6197 · (tentative d'exploit)	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6197 Chemin / cible / Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 69% Corrélation +10 Risque capteur Moyen · 59 Confiance : Confiance 59 % — 5 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6197 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6197 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "1a8856efb751068dcf45463a38bc696c0452b5d0", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.193499098775195, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6197, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "2c534c804da9c4dc5d907ed769aa1c7f3fbe5370", "event_fingerprint": "03dd1fc19457d90c7aa7a183aa0a1ca0edf1cb56", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.69, "classification_confidence": 0.69, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 10 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "ace5237527e3e8ffd75f46763d148293", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6197, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "18ce52aeff1e352cd99493c82466599229470bf5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6197, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "lfi path traversal \u00b7 via HTTP:6197 \u00b7 (tentative d'exploit)", "target_port_label": "6197 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 69, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 10 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6197, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6197, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:6197 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6197\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6197 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6197" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 9, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:00 UTC	TCP	5995 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:5995 · (tentative d'exploit)	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5995 Chemin / cible / Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 69% Corrélation +10 Risque capteur Moyen · 57 Confiance : Confiance 59 % — 5 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5995 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5995 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "8e8e5156811c5454c8e88e1f8ccc61627142e9fa", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 5995, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9f31032a4c60e2ca9afe719fa9370d7e58f53e06", "event_fingerprint": "95bfd1821be094d53d2fd061d101f1f24a0b80e7", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.69, "classification_confidence": 0.69, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 10 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "126ffd002cbf48c255ef50cd8e36a800", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5995, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46c1f725b4201e87b62e51f4d9bbcfbdafaa67a3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5995, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "lfi path traversal \u00b7 via HTTP:5995 \u00b7 (tentative d'exploit)", "target_port_label": "5995 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 69, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 10 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5995, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 5995, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:5995 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5995\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "5995 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5995" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 9, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:00 UTC	TCP	6161 · HTTP	http	Scan de ports port scan syn · via HTTP:6161 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6161 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6161 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6161 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "87d30d46f3ab8e7ed514ba310f0de2a214382c3c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.151900876705914, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6161, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5ed762d642ae9ebafe9cc5318c2c46035b65731b", "event_fingerprint": "e317d5ef93b7497f79f0d86e668ba8ceb394bad9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "5da0b5eccf6032567f864a45cac03935", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6161, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87c399c1f003700d83b2efb25524bfeed446ab34", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6161, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6161 \u00b7 (reconnaissance)", "target_port_label": "6161 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (85.217.149.0\/24)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 60, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6161, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6161, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6161 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6161\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6161 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6161" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 28.89, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 9, "behavior_alerts": [ "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 14:32:00 UTC	TCP	6435 · HTTP	http	Scan de ports port scan syn · via HTTP:6435 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6435 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6435 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6435 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "1b756658bbb37c96c69d5731e72188a9f774c7cb", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6435, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "fbe631db6f01cecebd8bb392d56f9354058c1043", "event_fingerprint": "a05fb367ebe0404846132bd0e7e1d0dc4e570278", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "97cc1c4baf7e482f35e2a5fde7937751", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6435, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3ef025b9e88e547eef64eb15b32f5bed46878556", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6435, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6435 \u00b7 (reconnaissance)", "target_port_label": "6435 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6435, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6435, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6435 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6435\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6435 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6435" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 5995, 6161, 6197, 6435 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 34.48, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 9, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 08:37:17 UTC	TCP	1768 · HTTP	http	Scan de ports port scan syn · via HTTP:1768 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1768 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1768 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1768 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "cf4d57eef8e4f26627e32b142685d0e129bbfa34", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.193499098775195, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1768, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 0, "campaign_key": "838aeb54114b0d5b4fc342a96032674c051b55a3", "event_fingerprint": "1b303a7768cb6ddff26ce08976b905d2f9f9d5e3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "5bcf72fd7481497c936c8caea3622251", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1768, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ca861efab55ae671cc7fa8c7e83024e305ca59fa", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1768, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1768 \u00b7 (reconnaissance)", "target_port_label": "1768 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1768, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1768, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1768 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1768\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1768 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1768" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 21, "port_scan_ports_sample": [ 1760, 1765, 1768, 1774, 1850, 1890, 1924, 1932, 6344, 6377, 6431, 6476, 6477, 6479, 6499, 6538 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 1.48, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_port_scan_slow" ] }
12/07/2026 08:37:16 UTC	TCP	6538 · HTTP	http	Scan de ports port scan syn · via HTTP:6538 · (reconnaissance)	Élevée	Moyen · 61
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6538 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 61 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6538 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6538 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "1d18eb513787ae96b7bf0f11f9c28d01943d4077", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.17549329810746, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6538, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 61, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e44ab58426ee8e66145c89481bfe42e61ebf4a93", "event_fingerprint": "7518dcfd0aebfccfa85d0e8ce35071167568fb17", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 61, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "29544f96e35500471d43c2e6104eef49", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6538, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b0386052a1d8193d41c7e8b5c4030d09498e1227", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6538, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6538 \u00b7 (reconnaissance)", "target_port_label": "6538 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 61, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6538, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6538, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6538 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6538\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6538 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6538" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 20, "port_scan_ports_sample": [ 1760, 1765, 1774, 1850, 1890, 1924, 1932, 6344, 6377, 6431, 6476, 6477, 6479, 6499, 6538, 6578 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 1.62, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 08:37:14 UTC	TCP	1924 · HTTP	http	Scan de ports port scan syn · via HTTP:1924 · (reconnaissance)	Élevée	Moyen · 57
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1924 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 57 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1924 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1924 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "8aa78acffdce343b1f4cd2079757e42b5e6c3473", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.1885651935322965, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 1924, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 57, "tag_count": 5, "anomaly_count": 0, "campaign_key": "c6575ff8577b851390dfdf364045ac09fb20865a", "event_fingerprint": "046222d53be704ddce447b3fe14d2a826b8a5d1b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "9ad0fd783ddc20e403e9690e20b7446c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1924, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7a7723ca9ee162f7e21d9347f69b8f51f72ab1ef", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1924, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:1924 \u00b7 (reconnaissance)", "target_port_label": "1924 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 57, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1924, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 1924, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:1924 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1924\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "1924 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1924" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 19, "port_scan_ports_sample": [ 1760, 1765, 1774, 1850, 1890, 1924, 1932, 6344, 6377, 6431, 6476, 6477, 6479, 6499, 6578, 6607 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 2.37, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 08:37:13 UTC	TCP	6377 · HTTP	http	Scan de ports port scan syn · via HTTP:6377 · (reconnaissance)	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6377 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +16 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6377 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6377 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "bd3ecbd246ae3109982f8f4656f0170de4724494", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.180427203350359, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6377, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "378d9e3bce29e6fbdcb90f4a661814264b7d3439", "event_fingerprint": "76bdeb104fefc6f3f2e51946b9ffdfb07efc15ff", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 60, "correlation_boost": 16 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "ba76414497e5d5c7aa18064e57a45f90", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6377, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "66563700c6dda1d5375980baa55f078f80718f0d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6377, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6377 \u00b7 (reconnaissance)", "target_port_label": "6377 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 60, "correlation_boost": 16 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6377, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +16", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6377, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6377 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6377\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6377 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6377" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 16, "port_scan_ports_sample": [ 1760, 1765, 1774, 1850, 1890, 1932, 6377, 6431, 6476, 6477, 6499, 6578, 6607, 6661, 6768, 6770 ], "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan" ], "correlation_confidence_boost": 16, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 08:37:13 UTC	TCP	6344 · HTTP	http	Scan de ports port scan syn · via HTTP:6344 · (reconnaissance)	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6344 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +16 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6344 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6344 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "b2c3cc79cb08cc5f59cf8e732d58ed66f1d3ca97", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.180427203350359, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6344, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "6385984e3ec1dafade19c0c67c465a2f43441f3b", "event_fingerprint": "354cd0475ebe4c40866614d5c0bbf87ce1893afa", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 16 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "a0f6f54371d44119835b708f0f5efc85", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6344, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "73e05c1348132280bd0bda8d921e874c5b285496", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6344, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6344 \u00b7 (reconnaissance)", "target_port_label": "6344 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 59, "correlation_boost": 16 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6344, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +16", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6344, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6344 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6344\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6344 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6344" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 17, "port_scan_ports_sample": [ 1760, 1765, 1774, 1850, 1890, 1932, 6344, 6377, 6431, 6476, 6477, 6499, 6578, 6607, 6661, 6768 ], "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "coordinated_scan" ], "correlation_confidence_boost": 16, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 08:37:13 UTC	TCP	6479 · HTTP	http	Scan de ports port scan syn · via HTTP:6479 · (reconnaissance)	Élevée	Moyen · 56
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6479 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 56 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6479 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6479 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "692f38637b2c84d1b1de14e91c9757e5a149276a", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.21470898438197, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6479, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 56, "tag_count": 5, "anomaly_count": 0, "campaign_key": "4927e92a5b8974fcfc114ad2e91d2b40a3bfdfea", "event_fingerprint": "90d8cfcde35aefa5758dbd200ac86008172cd587", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 56, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "3098a7f9ed603bf3dad1ab5bbbde342e", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6479, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d9c1974de93a74a8e028e0c5d34634afb830a05b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6479, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6479 \u00b7 (reconnaissance)", "target_port_label": "6479 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 56, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6479, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6479, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6479 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6479\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6479 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6479" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 18, "port_scan_ports_sample": [ 1760, 1765, 1774, 1850, 1890, 1932, 6344, 6377, 6431, 6476, 6477, 6479, 6499, 6578, 6607, 6661 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 5.31, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
12/07/2026 08:37:04 UTC	TCP	6477 · HTTP	http	Scan de ports port scan syn · via HTTP:6477 · (reconnaissance)	Élevée	Moyen · 61
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Scan coordonné MITRE T1046 TA0043 Protocole GET / UA Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Émulateur HTTP WAF 30 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6477 Chemin / cible / Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +20 Risque capteur Moyen · 61 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Règles WAF lfi-14 rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6477 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6477 User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "73dc7ed029f2004a098914a8b35ca849b9535326", "http_host_hash": "dcc4dbeb6a28d05edd10f2f2f68a3e8306805031", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 153, "payload_entropy": 5.201637088957134, "port_category": "registered", "org": "Modat B.V.", "service": "http", "app_proto": "http", "asn": 209334, "country": "CA", "dst_port": 6477, "risk_waf": 100, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25 }, "risk_score": 61, "tag_count": 5, "anomaly_count": 0, "campaign_key": "626c2b48761b73e2b055c3703057550fee53a6e2", "event_fingerprint": "760a5fb97a1b7ee39a885dfbb9864553c6e168ef", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 61, "correlation_boost": 20 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CA", "asn": 209334, "org": "Modat B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d36807a79ddb66c7e293111e6b04cf99", "payload_hash": "b1c8ddccf974d7c5d00f5af7f0546b73", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 6477, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "177aca031cb3a80dbeb3ebce9e6a5f8f0d2aff40", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6477, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "attack_vector": "port scan syn \u00b7 via HTTP:6477 \u00b7 (reconnaissance)", "target_port_label": "6477 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 25, "risk_score": 61, "correlation_boost": 20 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6477, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +20", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)", "port": 6477, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:6477 \u00b7 (reconnaissance)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6477\r\nUser-Agent: Mozilla\/5.0 (compatible; ModatScanner\/1.2; +https:\/\/modat.io\/)\r\nAccept: \/", "target_port_label": "6477 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +20 \u00b7 5 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6477" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 15, "port_scan_ports_sample": [ 1760, 1765, 1774, 1850, 1890, 1932, 6431, 6476, 6477, 6499, 6578, 6607, 6661, 6768, 6770 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 2.58, "coordinated_scan": true, "coordinated_subnet": "85.217.149.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "coordinated_scan" ], "correlation_confidence_boost": 20, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }

85.217.149.70

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence