|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �Y
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �Y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.3962406251802895,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2c1113bdf33f2d2f5b6d06dcd2222903",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2184c9c09ce5dea02eb528dadb4ef5acbabc4af1",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdY",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdY\u0000\u0015",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdY",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i ) �s
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i ) �s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.41829583405449,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c0786724c9774914304a2bbbc8b94805",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f0d82098df38aaaf1e5cb4ede556ff88a289b89",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni)\ufffds",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000)\u001d\ufffds",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni)\ufffds",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g �)
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g �)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "00f3fa520ab60694db85335efc5b068b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a84fd6d9ef5842683195cceecdb34365bebc749",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd)",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd)\u000e\u0016",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { mx~
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { mx~
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8985d4d68e9314daf284940f8893b4f9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "952e2a2a20295dda8d16ec63dcf8888066967114",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{mx~",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000mx~\u001a",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{mx~",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ��F
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ��F
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "06381c367ac7d955fdd4250e6c1489a9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4c873b64c61807480665e1455d8a18e79373fac6",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdF",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdF\u0010",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdF",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �mq
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �mq
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bda43dafbd639e7ffb4f65a5e530a6d8",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9990a80b2006b58f8f1c48c1866d74326d188f81",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdmq",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0004\ufffdmq",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdmq",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g �b V
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g �b
V
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fcda8422f553464b96f6caa6e234203b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f04abf72e017a366de42508a5d5f475351136de",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffdb\nV",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffdb\nV",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffdb\nV",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g r\��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g r\��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f56b91335d9cdc1637a1c36c635ee633",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "17b371bcf6bb5809539903f1abf0959862c7b837",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongr\\\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000r\\\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongr\\\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i 0�o+
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i 0�o+
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.41829583405449,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "80cbdc27a158741e49e6d1b95975ee31",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e8f313b38d13c918c7a6e25e1081aaf07e7c7aa",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni0\ufffdo+",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u00000\ufffdo+",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni0\ufffdo+",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { <M�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { <M�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e661070f4ab6c1a5bf468d0b7e04b216",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14bba73014f758a14227ab94d09b26a55cfb8e4f",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{<M\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000<M\ufffd\u000f",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{<M\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version z ɸƈ
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version z ɸƈ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "696a5bc74a66cfbed355d5a405d77569",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b198e01f7ac707f07c1b50042887847be4a34e76",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionz\u0278\u0188",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0278\u0188",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionz\u0278\u0188",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f �q�L
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f �q�L
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "84571704f634d6df015d26c65adadf5a",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73cdea9fadec488de43f41361f364cc10c232f46",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffdq\ufffdL",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffdq\ufffdL",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffdq\ufffdL",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version q `оN
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version q `оN
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae8e23734452c82393052bedac9ae9d8",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b930ef5095f48b410a918c5bf5b97946039d4463",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionq`\u043eN",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000`\u043eN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionq`\u043eN",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde PostgreSQL
postgres probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g &�y
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g
&�y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0369",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "bitcoin",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "be38823dfe802fa2bbd3ffba7af2a89e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 35
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7d3c0043b863342bac3ac0af8b5da13ba615646",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\n&\ufffdy",
"attack_vector": "postgres probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\n&\ufffdy",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "postgres probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\n&\ufffdy",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i #��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i #��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bcd28ce74cf805bbbbfc5161ab2383fd",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b486086764cd785af2e9791e36012e5b4af38008",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni#\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000#\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni#\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g ��H�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g ��H�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bad0e506ae4d71f43bf4bc2209d6e7e8",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba796742f317cfe56b9e464ea29337e1965283bc",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffdH\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffdH\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffdH\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i �=�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i �=�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.312907291846956,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "189e8bcfef0c57e0ab29449c5a396750",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b103ee2a55300806be60eeb442fb53fc142fd7d",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd=\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\u0000\ufffd=\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd=\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version e p��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version e p��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d9852fb1ef1f76180d424b94f15264c7",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "390d03117b0a815390caeffba171369d67f877f1",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionep\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000p\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionep\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i �)�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i �)�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1b5a23c0ac4c22c4debe608eae30cad6",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74785dc1fb81e9d1bbffae38ba88a671251a8459",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd)\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u001b)\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd)\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g R��P
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g R��P
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8fc45446a9783f1b5a96ce6d31feb57f",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f563d4d510d9e7be257b420418d4be2813226dc6",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongR\ufffd\ufffdP",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000R\ufffd\ufffdP",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongR\ufffd\ufffdP",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g �_mf
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g �_mf
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b311f77e7b8946cdd13fca94b632fef4",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1903d79a699eb53a2e6c40e7d1fac0a891da258d",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd_mf",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd_mf",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd_mf",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { _T��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { _T��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "52157c5065416e5a49ddb89c98c8bc56",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "40beb38edcb05fc26a7f4fdf332814d86140d2b3",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{_T\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000_T\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{_T\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f �L
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f �L
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a538f62b88b86ceb1b00b6523ae10fef",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d7583c19c9ce232e52722f3cb4367f3f561a1eb",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffdL",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\u0014\u000fL",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffdL",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �gU�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �gU�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "871bf0593515707c3eae6913bf21b525",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbe07533b0977b784913230f996509d50aba3af9",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdgU\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdgU\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdgU\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �+�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �+�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "89a14cb97805b1692bed32c5267b0613",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2fd596f9237cd2802a2ff6399091d6f18ce09f2a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd+\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0007+\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd+\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3c480b10b41de88bce442c1210ca3804",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66a8b04a04d0f729eb199a53054edf34777b7418",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0014\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �q?
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �q?
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0a9c50af442f94e2b53832f2ea7247cf",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9560940651e56c96ee7a36f377a90d2300219a02",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdq?",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdq?",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdq?",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "92ef2cc45fce5b0412fe7a3eea37e95b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "05b73112d64e4fa599f1df998e2f1b8e9c633322",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version q �Z'�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version q �Z'�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb33fb4b3aa4550c41f641cb354cec34",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5db4f6a3d9f1c4eee71003846d1e5afa04c39b8",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionq\ufffdZ'\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000\ufffdZ'\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionq\ufffdZ'\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version h ��L
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version h ��L
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ab2b82ff48292d383b3c5267efa593e9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3692e0001c378a4f21d6b0948ccb85255a9c94b2",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\ufffd\ufffdL",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdL\u0002",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\ufffd\ufffdL",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �4�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �4�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "14e47d572cb7e6e6ffe932fd13d76992",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "127ee4a8676e15c0d84a48dbb5e9155c4428c65c",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd4\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd4\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd4\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f �9�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f �9�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6dfaef1c507c1b4b32d14c4c9e02d771",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "286f57260d6964f4875488425658c9459c8dfee2",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd9\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0011\ufffd9\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd9\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version z FA�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version z FA�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dc09d96eb915ad5595e3398e19ec7373",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a90e7fec9031de77e1481c97f1e48523eb91b4e",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionzFA\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u001bFA\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionzFA\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f ���1
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f ���1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c68016a59ed25797dce2d92f30b2984d",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "787eb3a9ccad4b9612c74d45af83feeb1cdd4f0e",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd1",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd1",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd1",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version ~ ?cۤ
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version ~ ?cۤ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4c18c838bcb11f8ec43e1226324bb1cc",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b2ff52a20dd742f0b30b66438e002b3419258ae",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion~?c\u06e4",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000?c\u06e4",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion~?c\u06e4",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g N���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g N���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "aec5f1cff72452c03b20bafcb74ddd34",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5cb83681f283d60037dbad638a5948fa13b0a6ed",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongN\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000N\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiongN\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ��sa
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ��sa
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "feb2108dd777e6a2104b0ab35187653a",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "daee715a22b1c182f9157526df28a18fdead7eb0",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdsa",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffdsa",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdsa",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version h ��z8
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version h ��z8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a25277ab032e10a147d99c951545485c",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b9df72265ae7b6c290e2eeafd15090457b75823",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\ufffd\ufffdz8",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\ufffd\ufffdz8",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\ufffd\ufffdz8",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version ~ +�'*
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version ~ +�'*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "804e179070eaaeda15ca06382bccfbb0",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9fbb522274e910de7b404563015f12b4df75f149",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion~+\ufffd'*",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000~\u0000\u0000\u0000+\ufffd'*",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion~+\ufffd'*",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f ��;�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f ��;�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d9b64a1050a74ed0f5cf5535154f981",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f16bbfcfe0609e60d292a2547d56563f51e8e413",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd;\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd;\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd;\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version n ��o
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version n ��o
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.41829583405449,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fd4ff9115494edeb57084db6f80254cd",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0985c48006309ace3763b5b6d3f93d75d08149a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionn\ufffd\ufffdo",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd\ufffd\u0011o",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionn\ufffd\ufffdo",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version h Y�p�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version h Y�p�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8e681f01d0bed22e7f9f6df0f911f2aa",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a53badd6e10489f2147904fe130b715fffc7210",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionhY\ufffdp\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffdp\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionhY\ufffdp\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i ����
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i ����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4ba4fa894fa2210bbefa04332896ea5f",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a8aa47a85edf1cc75fa910de40bfd3664bf89b5e",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version e }琻
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version e }琻
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d88999a3b36c8d1a8793fa266e16507",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5abcf631ae6101f52af525b5c534b74d01d7604",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione}\u743b",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000}\u743b",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione}\u743b",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �A�N
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �A�N
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "788abdee16fc68c2762d1c7695aa1687",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1d898ba8cfb340a70bb1cccd2d43c644a03d4e59",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdA\ufffdN",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdA\ufffdN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdA\ufffdN",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ��8
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ��8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a8eceafaf07cbc1e0cce9311b5db77dd",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8 ",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8 ",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8 ",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95750ec7b5cb22525419bb5ff91e8878c88437bc",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd8",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd8",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd8",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "723578412f6e10488b492e958881ad0b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc119b51629ed51717ea0c05285b5b2fb6a0c37a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { G1 �
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { G1 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a5dd6c1f30bcc5fd0bfefb3ea16877f",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e2a0b430f65561c027752dd75b63249f70c26b1",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{G1\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000G1\f\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{G1\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { @� N
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { @�
N
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0d59f5df2594101f3c0b22cd046e0923",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "748d53c7c64e15a2c1ee3f44f3870a9160d22445",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{@\ufffd\nN",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000@\ufffd\nN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{@\ufffd\nN",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g "H�a
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g "H�a
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "HU",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HU",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d57660d3032f219b3602d80c9be2af5",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d992aa453b7e292bc7e7094f6fc3d8c0b8ede73b",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\"H\ufffda",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\"H\ufffda",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\"H\ufffda",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "87.229.79.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|