|
|
TCP |
3790 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:3790 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA fasthttp
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3790
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
fasthttp
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
User-Agent: fasthttp
Host: 62.3.50.33:3790
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8f70bcb6fa12d6f9618bfc12da1177fff7a7bc57",
"http_host_hash": "1bc2d4d1967f7599ab2ee7ed40e081cabf8aa2f9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 63,
"payload_entropy": 4.7729259079296416,
"port_category": "registered",
"org": "IP Volume inc",
"service": "http",
"app_proto": "http",
"asn": 202425,
"country": "NL",
"dst_port": 3790,
"risk_waf": 20,
"risk_classification": 8,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "bfa7976414142a0df49d7a42deed44de29bdb83a",
"event_fingerprint": "b5b54486e9386cf3190da24e2beb74dbfb1478ee",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "839d98aac393eabedcd815b51e257d25",
"payload_hash": "cdc6f08915e985653b06931d35c01dca",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 3790,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "fasthttp",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "fasthttp",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%"
},
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6320ec2c91f78b0615707937a7692c33c8e39598",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "fasthttp",
"port": 3790,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790",
"attack_vector": "http \u00b7 via HTTP:3790 \u00b7 (sonde \/ probe)",
"target_port_label": "3790 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3790,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "fasthttp",
"port": 3790,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:3790 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:3790",
"target_port_label": "3790 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3790"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
5901 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:5901 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 3154afed186248e4
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5901
Chemin / cible
—
Service
TLS
Payload
� ��} fU�"��y�5�a��v����&��ˀ��i2 �����ð�)c��W*QV����܆�mF�$�e 2�+�/�,�0̨̩� �� � � � / 5� �#�' <��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��} fU�"��y�5�a��v����&��ˀ��i2 �����ð�)c��W*QV����܆�mF�$�e 2�+�/�,�0̨̩� ��
� � � / 5�
�#�' <��
Requête brute (extrait)
� ��} fU�"��y�5�a��v����&��ˀ��i2 �����ð�)c��W*QV����܆�mF�$�e 2�+�/�,�0̨̩� �� � � � / 5� �#�' <�� O # � � + 3�����}_<ֳ�M(|�{I�>%�9
Meta JSON brut
{
"tls_ja3_hash": "3154afed186248e4332a48541cfec9f1",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 7,
"bytes_in": 1491,
"payload_entropy": 7.700539685826144,
"port_category": "registered",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 5901,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "aaf6c90061ee1487712014f5ea86d12f50e8bb55",
"event_fingerprint": "5f02929633951210979c01f1e7ba0b29db6497d0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3154afed186248e4332a48541cfec9f1",
"payload_hash": "aba75e7e81e4f87b08ed3a1b6137d490",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5901,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd}\u0000fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2\u0013 \ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\u0018\ufffd\u0706\ufffdmF\ufffd$\ufffd\u0001e\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd}\u0000fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2\u0013 \ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\u0018\ufffd\u0706\ufffdmF\ufffd$\ufffd\u0001e\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005O\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u000e\ufffd}_\u0003\u0001<\u05b3\ufffdM(|\ufffd{I\ufffd>%\u0006\ufffd9",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd}\u0000fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2\u0013 \ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\u0018\ufffd\u0706\ufffdmF\ufffd$\ufffd\u0001e\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82b81e644985e3516ce91a364e7df66c8c9bfef4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd}\u0000fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2\u0013 \ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\u0018\ufffd\u0706\ufffdmF\ufffd$\ufffd\u0001e\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"tls_ja3": "3154afed186248e4332a48541cfec9f1",
"port": 5901,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd}fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2 \ufffd\ufffd\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\ufffd\u0706\ufffdmF\ufffd$\ufffde2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:5901 \u00b7 (sonde \/ probe)",
"target_port_label": "5901 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5901,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd}\u0000fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2\u0013 \ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\u0018\ufffd\u0706\ufffdmF\ufffd$\ufffd\u0001e\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"tls_ja3": "3154afed186248e4332a48541cfec9f1",
"port": 5901,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:5901 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd}fU\ufffd\"\ufffd\ufffdy\ufffd5\ufffda\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\u02c0\ufffd\ufffdi2 \ufffd\ufffd\ufffd\ufffd\ufffd\u00f0\ufffd)c\ufffd\ufffdW*QV\ufffd\ufffd\ufffd\ufffd\u0706\ufffdmF\ufffd$\ufffde2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"target_port_label": "5901 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5901"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
137 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:137 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 3154afed186248e4
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
137
Chemin / cible
—
Service
TLS
Payload
� ��z���6hG��?~�tQ@��km#w�CB��� !�` #�;�Uh�\�䢣�Kz�t� >^�%��2d]�� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��z���6hG��?~�tQ@��km#w�CB���
!�` #�;�Uh�\�䢣�Kz�t� >^�%��2d]�� 2�+�/�,�0̨̩� ��
� � � / 5�
�#�' <��
Requête brute (extrait)
� ��z���6hG��?~�tQ@��km#w�CB��� !�` #�;�Uh�\�䢣�Kz�t� >^�%��2d]�� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <�� O # � � + 3����TC" �c�Nw��W��5��x
Meta JSON brut
{
"tls_ja3_hash": "3154afed186248e4332a48541cfec9f1",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 7,
"bytes_in": 1491,
"payload_entropy": 7.742599535506104,
"port_category": "well_known",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 137,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2414dd5c536685d2882b1b6839f3e42ac4b29411",
"event_fingerprint": "4e477e31c9b38661257f41758cad5d6fb51f32f5",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "3154afed186248e4332a48541cfec9f1",
"payload_hash": "d08039aea77af1e57d6cb9af3daf13fd",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 137,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\u001d\t\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\u001d\t\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005O\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdTC\" \u0004\ufffdc\u0007\ufffdNw\u0002\ufffd\ufffdW\ufffd\ufffd5\u0005\u0003\ufffd\ufffdx",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\u001d\t\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a634f65a06ccdd359877c70ce63bbace3d5075e4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\u001d\t\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"tls_ja3": "3154afed186248e4332a48541cfec9f1",
"port": 137,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\t2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:137 \u00b7 (sonde \/ probe)",
"target_port_label": "137 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 137,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\u001d\t\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"tls_ja3": "3154afed186248e4332a48541cfec9f1",
"port": 137,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:137 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd6hG\ufffd\ufffd?~\ufffdtQ@\ufffd\ufffdkm#w\ufffdCB\ufffd\ufffd\ufffd\n!\ufffd` #\ufffd;\ufffdUh\ufffd\\\ufffd\u48a3\ufffdKz\ufffdt\ufffd\t>^\ufffd%\ufffd\ufffd2d]\ufffd\ufffd\t2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"target_port_label": "137 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "137"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
137 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:137 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
137
Chemin / cible
—
Service
TLS
Payload
� �4Ò A%��!Ud�3�U��L Ob�}+(�>� i�A�E��*~.k:�f���Aa�� A�!��{�> &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4Ò A%��!Ud�3�U��L Ob�}+(�>� i�A�E��*~.k:�f���Aa�� A�!��{�> &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �4Ò A%��!Ud�3�U��L Ob�}+(�>� i�A�E��*~.k:�f���Aa�� A�!��{�> &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ wYj�x��@������@��ȅR����ۓ��W
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.7881078776328945,
"port_category": "well_known",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 137,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2414dd5c536685d2882b1b6839f3e42ac4b29411",
"event_fingerprint": "c1851c82b27dea7edbc5031c4080c0e7e36e4453",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "9345cf41ec225b07d3755bc22599d377",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 137,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\u00d2\u001dA%\ufffd\ufffd\u00ad!Ud\ufffd3\u0013\ufffdU\ufffd\ufffd\u0003L\u000bOb\ufffd}+(\ufffd>\ufffd i\ufffd\u0005A\ufffd\u0013E\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffd\u0000A\ufffd!\ufffd\ufffd{\ufffd>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\u00d2\u001dA%\ufffd\ufffd\u00ad!Ud\ufffd3\u0013\ufffdU\ufffd\ufffd\u0003L\u000bOb\ufffd}+(\ufffd>\ufffd i\ufffd\u0005A\ufffd\u0013E\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffd\u0000A\ufffd!\ufffd\ufffd{\ufffd>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 wYj\ufffdx\u05ce\ufffd\ufffd@\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\u0205R\ufffd\ufffd\ufffd\ufffd\u06d3\ufffd\ufffdW",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\u00d2\u001dA%\ufffd\ufffd\u00ad!Ud\ufffd3\u0013\ufffdU\ufffd\ufffd\u0003L\u000bOb\ufffd}+(\ufffd>\ufffd i\ufffd\u0005A\ufffd\u0013E\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffd\u0000A\ufffd!\ufffd\ufffd{\ufffd>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b972ad2738e2131d21319ecfd9d556b973c5c75b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\u00d2\u001dA%\ufffd\ufffd\u00ad!Ud\ufffd3\u0013\ufffdU\ufffd\ufffd\u0003L\u000bOb\ufffd}+(\ufffd>\ufffd i\ufffd\u0005A\ufffd\u0013E\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffd\u0000A\ufffd!\ufffd\ufffd{\ufffd>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 137,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd4\u00d2A%\ufffd\ufffd\u00ad!Ud\ufffd3\ufffdU\ufffd\ufffdLOb\ufffd}+(\ufffd>\ufffd i\ufffdA\ufffdE\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffdA\ufffd!\ufffd\ufffd{\ufffd>&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:137 \u00b7 (sonde \/ probe)",
"target_port_label": "137 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 137,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\u00d2\u001dA%\ufffd\ufffd\u00ad!Ud\ufffd3\u0013\ufffdU\ufffd\ufffd\u0003L\u000bOb\ufffd}+(\ufffd>\ufffd i\ufffd\u0005A\ufffd\u0013E\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffd\u0000A\ufffd!\ufffd\ufffd{\ufffd>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 137,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:137 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd4\u00d2A%\ufffd\ufffd\u00ad!Ud\ufffd3\ufffdU\ufffd\ufffdLOb\ufffd}+(\ufffd>\ufffd i\ufffdA\ufffdE\ufffd\ufffd*~.k:\ufffdf\ufffd\ufffd\ufffdAa\ufffd\ufffdA\ufffd!\ufffd\ufffd{\ufffd>&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "137 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "137"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
9107 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9107 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA fasthttp
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9107
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
fasthttp
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
User-Agent: fasthttp
Host: 62.3.50.33:9107
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8f70bcb6fa12d6f9618bfc12da1177fff7a7bc57",
"http_host_hash": "0b4533cab20c9546f30d297b455c28a40d32f627",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 63,
"payload_entropy": 4.78070725706731,
"port_category": "registered",
"org": "IP Volume inc",
"service": "http",
"app_proto": "http",
"asn": 202425,
"country": "NL",
"dst_port": 9107,
"risk_waf": 20,
"risk_classification": 8,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "7d409347f08a834d8113c843586679e52de939c6",
"event_fingerprint": "3611664c0dafe1ee1f65b0c2c48768feb7ac5601",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "839d98aac393eabedcd815b51e257d25",
"payload_hash": "bf46677f10f9e4b9e74fcb3109a7aaf8",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 9107,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "fasthttp",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "fasthttp",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%"
},
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fdf7edf00a5571d31fa2ebb980bfd1228c40b8fb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "fasthttp",
"port": 9107,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107",
"attack_vector": "http \u00b7 via HTTP:9107 \u00b7 (sonde \/ probe)",
"target_port_label": "9107 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9107,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "fasthttp",
"port": 9107,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9107 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:9107",
"target_port_label": "9107 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9107"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
1098 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1098 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1098
Chemin / cible
—
Service
TLS
Payload
� �jSr�+��I��/�"7���V����"�� � � ɑ�\���7�����C���U� ��]� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �jSr�+��I��/�"7���V����"�� � � ɑ�\���7�����C���U� ��]� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �jSr�+��I��/�"7���V����"�� � � ɑ�\���7�����C���U� ��]� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ IE�BT͂�B�|v�+���!�Rb�>9���7b
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.784645296963399,
"port_category": "registered",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 1098,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f1b4ba2ba2a021a1b177e6f837aaa57a39c9071f",
"event_fingerprint": "f07504e33213f04acd3803ce26bf3c73f501c69b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "5a9edfb609e393b8acc3669d8a24ee26",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1098,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003jSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\u0006\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\u0011\ufffd\ufffd\u0016\ufffd\"\ufffd\ufffd \ufffd\u0000\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\u0002C\ufffd\ufffd\ufffdU\ufffd \u001f\ufffd\u000e\ufffd\u0002]\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003jSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\u0006\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\u0011\ufffd\ufffd\u0016\ufffd\"\ufffd\ufffd \ufffd\u0000\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\u0002C\ufffd\ufffd\ufffdU\ufffd \u001f\ufffd\u000e\ufffd\u0002]\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 IE\ufffdBT\u0342\ufffd\u0016B\ufffd|v\ufffd+\ufffd\ufffd\ufffd!\ufffdRb\u0002\ufffd\u0015>9\ufffd\ufffd\ufffd7b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003jSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\u0006\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\u0011\ufffd\ufffd\u0016\ufffd\"\ufffd\ufffd \ufffd\u0000\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\u0002C\ufffd\ufffd\ufffdU\ufffd \u001f\ufffd\u000e\ufffd\u0002]\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d5c024f097e3eef290c9245cf54db02ea556b60",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003jSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\u0006\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\u0011\ufffd\ufffd\u0016\ufffd\"\ufffd\ufffd \ufffd\u0000\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\u0002C\ufffd\ufffd\ufffdU\ufffd \u001f\ufffd\u000e\ufffd\u0002]\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1098,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdjSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd \ufffd\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffdU\ufffd \ufffd\ufffd]\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:1098 \u00b7 (sonde \/ probe)",
"target_port_label": "1098 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1098,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003jSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\u0006\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\u0011\ufffd\ufffd\u0016\ufffd\"\ufffd\ufffd \ufffd\u0000\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffd\u0002C\ufffd\ufffd\ufffdU\ufffd \u001f\ufffd\u000e\ufffd\u0002]\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1098,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdjSr\ufffd+\ufffd\ufffdI\ufffd\ufffd\/\ue5b3\ufffd\"7\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd \ufffd\ufffd\t\u0251\ufffd\\\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffdU\ufffd \ufffd\ufffd]\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "1098 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (89.248.172.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "89.248.172.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
7895 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:7895 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7895
Chemin / cible
—
Service
TLS
Payload
� ���:iI�I����ɠ�DŽfI ��!��W:, ��=�O>8=��W�C[?�L�<,��"��ཅ &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���:iI�I����ɠ�DŽfI ��!��W:, ��=�O>8=��W�C[?�L�<,��"��ཅ &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���:iI�I����ɠ�DŽfI ��!��W:, ��=�O>8=��W�C[?�L�<,��"��ཅ &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ 64�a����ܺ-��&M)���[e�:�wSm�T
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.833531146676586,
"port_category": "registered",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 7895,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c206175826798a65756500e638530150117063d1",
"event_fingerprint": "c290a75fb4e30b7064684ba3e2bea6c1145c7c08",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "fe31ef02ecc5d26a94ae3682a29c04a1",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 7895,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\u0005\ufffd\u0260\ufffd\u01c4fI\f\ufffd\ufffd!\ufffd\u0007\ufffdW:, \ufffd\ufffd\u0017=\ufffdO\u0012>8=\u0014\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\u001a\ufffd\"\ufffd\ufffd\u0f45\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\u0005\ufffd\u0260\ufffd\u01c4fI\f\ufffd\ufffd!\ufffd\u0007\ufffdW:, \ufffd\ufffd\u0017=\ufffdO\u0012>8=\u0014\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\u001a\ufffd\"\ufffd\ufffd\u0f45\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 64\ufffda\ufffd\ufffd\ufffd\ufffd\u0019\u073a-\ufffd\ufffd&M)\ufffd\ufffd\ufffd\u0017[e\ufffd:\ufffdwS\u0019m\ufffdT",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\u0005\ufffd\u0260\ufffd\u01c4fI\f\ufffd\ufffd!\ufffd\u0007\ufffdW:, \ufffd\ufffd\u0017=\ufffdO\u0012>8=\u0014\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\u001a\ufffd\"\ufffd\ufffd\u0f45\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e97bcc00d020d0d6f6d760c34bd0b171dc2356c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\u0005\ufffd\u0260\ufffd\u01c4fI\f\ufffd\ufffd!\ufffd\u0007\ufffdW:, \ufffd\ufffd\u0017=\ufffdO\u0012>8=\u0014\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\u001a\ufffd\"\ufffd\ufffd\u0f45\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 7895,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\ufffd\u0260\ufffd\u01c4fI\ufffd\ufffd!\ufffd\ufffdW:, \ufffd\ufffd=\ufffdO>8=\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\ufffd\"\ufffd\ufffd\u0f45&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:7895 \u00b7 (sonde \/ probe)",
"target_port_label": "7895 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 7895,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0005\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\u0005\ufffd\u0260\ufffd\u01c4fI\f\ufffd\ufffd!\ufffd\u0007\ufffdW:, \ufffd\ufffd\u0017=\ufffdO\u0012>8=\u0014\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\u001a\ufffd\"\ufffd\ufffd\u0f45\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 7895,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:7895 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd:iI\ufffdI\ufffd\ufffd\ufffd\ufffd\u0260\ufffd\u01c4fI\ufffd\ufffd!\ufffd\ufffdW:, \ufffd\ufffd=\ufffdO>8=\ufffd\ufffdW\ufffdC[?\ufffdL\ufffd<,\ufffd\ufffd\"\ufffd\ufffd\u0f45&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "7895 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "7895"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8285 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:8285 · (sonde / probe)
|
Faible
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA fasthttp
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8285
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
fasthttp
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
User-Agent: fasthttp
Host: 62.3.50.33:8285
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8f70bcb6fa12d6f9618bfc12da1177fff7a7bc57",
"http_host_hash": "a222cbbebf8b0ff84ba130c89df49e24004af86c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 63,
"payload_entropy": 4.760943566625459,
"port_category": "registered",
"org": "IP Volume inc",
"service": "http",
"app_proto": "http",
"asn": 202425,
"country": "NL",
"dst_port": 8285,
"risk_waf": 20,
"risk_classification": 8,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "239c7c4638c3689bb61e9b21137f5be2187acd15",
"event_fingerprint": "cc04d1d14e503d7f60b5a51d6b6eca066cfc00ce",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "839d98aac393eabedcd815b51e257d25",
"payload_hash": "df0e97925851ef4dd7c00de5697c47db",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 8285,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "fasthttp",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "fasthttp",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%"
},
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10a25a23a53d929b3d81ad62d57faabb17df8e67",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "fasthttp",
"port": 8285,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285",
"attack_vector": "http \u00b7 via HTTP:8285 \u00b7 (sonde \/ probe)",
"target_port_label": "8285 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 20,
"classification": 8,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8285,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "fasthttp",
"port": 8285,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:8285 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: fasthttp\r\nHost: 62.3.50.33:8285",
"target_port_label": "8285 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8285"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
1198 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1198 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1198
Chemin / cible
—
Service
TLS
Payload
� �> �����C,��"�4���?E�� ?p��g �v�ѷ�8�M��k�*��H��t�o@V��:� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �> �����C,��"�4���?E��
?p��g �v�ѷ�8�M��k�*��H��t�o@V��:� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �> �����C,��"�4���?E�� ?p��g �v�ѷ�8�M��k�*��H��t�o@V��:� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��XA��+�M��71� ��� 8�M��x�u
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.880218218070619,
"port_category": "registered",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 1198,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "878bcf7eb073d1d57f02499bd49c47920043889c",
"event_fingerprint": "80f326202fb068d144e75022c8d6297accd8c81f",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "5218145d1828b2e519db73967f16b3f5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1198,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u001f\ufffd\ufffd\ufffd\u0011\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffd\u0004g \ufffd\u0010v\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@\u0017V\u0001\ufffd\ufffd:\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u001f\ufffd\ufffd\ufffd\u0011\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffd\u0004g \ufffd\u0010v\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@\u0017V\u0001\ufffd\ufffd:\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdXA\ufffd\ufffd+\u0003\ufffdM\ufffd\ufffd7\u00131\ufffd\f\u001e\ufffd\ufffd\ufffd\u001c8\ufffdM\ufffd\u001b\ufffdx\ufffdu",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u001f\ufffd\ufffd\ufffd\u0011\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffd\u0004g \ufffd\u0010v\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@\u0017V\u0001\ufffd\ufffd:\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87063f77bdeac41152580ce41470d8859746a404",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u001f\ufffd\ufffd\ufffd\u0011\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffd\u0004g \ufffd\u0010v\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@\u0017V\u0001\ufffd\ufffd:\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1198,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffdg \ufffdv\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@V\ufffd\ufffd:\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:1198 \u00b7 (sonde \/ probe)",
"target_port_label": "1198 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1198,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u001f\ufffd\ufffd\ufffd\u0011\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffd\u0004g \ufffd\u0010v\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@\u0017V\u0001\ufffd\ufffd:\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1198,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1198 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffdC,\ufffd\ufffd\"\ufffd4\ufffd\ufffd\ufffd?E\ufffd\ufffd\n?p\ufffd\ue0e0\ufffdg \ufffdv\ufffd\u0477\ufffd8\ufffdM\ufffd\ufffdk\ufffd*\ufffd\ufffdH\ufffd\ufffdt\ufffdo@V\ufffd\ufffd:\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "1198 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1198"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
1293 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1293 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1293
Chemin / cible
—
Service
TLS
Payload
� ��8>��!G��i)`���b����= 6����� ��h� sڡ(�%��y�G�@D͓��"�k� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��8>��!G��i)`���b����= 6����� ��h� sڡ(�%��y�G�@D͓��"�k� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��8>��!G��i)`���b����= 6����� ��h� sڡ(�%��y�G�@D͓��"�k� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ WѶ X���[�{�OŦCLJ�7���6�s�L
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.86769347737274,
"port_category": "registered",
"org": "IP Volume inc",
"service": "tls",
"app_proto": "tls",
"asn": 202425,
"country": "NL",
"dst_port": 1293,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4a6e175c5777ede0aa753e3bc36c6a50def49307",
"event_fingerprint": "782f246c6784435131cc0ebf2bbbe76c3c24f98d",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "66b2bf1f43654f29f4dc7bd7d482546e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1293,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8>\ufffd\ufffd!G\ufffd\u0012\ufffdi)`\ufffd\u0011\u0012\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=\u000b6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\u001b\u0016\ufffd\u001cs\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\u0016\"\u0016\ufffdk\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8>\ufffd\ufffd!G\ufffd\u0012\ufffdi)`\ufffd\u0011\u0012\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=\u000b6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\u001b\u0016\ufffd\u001cs\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\u0016\"\u0016\ufffdk\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 W\u0014\u0476\u0014\nX\ufffd\ufffd\ufffd[\ufffd{\ufffd\u0014O\u0166C\u01c7\ufffd7\u0019\ufffd\ufffd\ufffd6\ufffds\ufffdL",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8>\ufffd\ufffd!G\ufffd\u0012\ufffdi)`\ufffd\u0011\u0012\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=\u000b6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\u001b\u0016\ufffd\u001cs\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\u0016\"\u0016\ufffdk\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d5e31b7130290479c10fdd57a5f22ddce1f9ef1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8>\ufffd\ufffd!G\ufffd\u0012\ufffdi)`\ufffd\u0011\u0012\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=\u000b6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\u001b\u0016\ufffd\u001cs\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\u0016\"\u0016\ufffdk\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1293,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd8>\ufffd\ufffd!G\ufffd\ufffdi)`\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\ufffds\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\"\ufffdk\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:1293 \u00b7 (sonde \/ probe)",
"target_port_label": "1293 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1293,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd8>\ufffd\ufffd!G\ufffd\u0012\ufffdi)`\ufffd\u0011\u0012\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=\u000b6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\u001b\u0016\ufffd\u001cs\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\u0016\"\u0016\ufffdk\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1293,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1293 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd8>\ufffd\ufffd!G\ufffd\ufffdi)`\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd=6\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdh\ufffds\u06a1(\ufffd%\ufffd\ufffdy\ufffdG\ufffd@D\u0353\ufffd\ufffd\"\ufffdk\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "1293 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1293"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|