|
|
TCP |
18049 · HTTP
|
http
|
probe health
probe health · via HTTP:18049 · (sonde / probe) · → /health
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
18049
Chemin / cible
/health
Pourquoi cette classification : Type « probe_health » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
Benign Health
Chemin bénin connu
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:18049
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br,
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:18049 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "f31a51b8e3c918b0410aacb2fda14fef9fb44053",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.158733342175459,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 18049,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "add0f11d75064680da59bea3cf19c3616edbc8b4",
"event_fingerprint": "4f17d0331bb9fb23a08d6c409800561318084c47",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-benign-health",
"INT-benign-path-cap"
],
"classification_reason": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "77ebc8a09e3fbbf56d8176b095e69c50",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 18049,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, ",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"classification_reason": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9191d0ff73295d10f18b8a6a9d0b6f611745cd3e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 18049,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"attack_vector": "probe health \u00b7 via HTTP:18049 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/health",
"target_port_label": "18049 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18049,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-health",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Benign Health",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 18049,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe health \u00b7 via HTTP:18049 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:18049\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"target_port_label": "18049 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18049"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
16100 · HTTP
|
http
|
probe health
probe health · via HTTP:16100 · (sonde / probe) · → /health
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
16100
Chemin / cible
/health
Pourquoi cette classification : Type « probe_health » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
Benign Health
Chemin bénin connu
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:16100
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br,
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:16100 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "468f2d7ed5d35c5878089f046d359203d6f90dcc",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.108330746791095,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 16100,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f49bb940225e17d80d1cd2b4d61c6a67d6e030ae",
"event_fingerprint": "cfb4ce955bf4f4fea5780afe7bb8d003d145435d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-benign-health",
"INT-benign-path-cap"
],
"classification_reason": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "44911a943e6ed1b21e06db9d0b63b147",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 16100,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, ",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"classification_reason": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31b5622c31d5706b83ec5f016e2ac769f10f511a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 16100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"attack_vector": "probe health \u00b7 via HTTP:16100 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/health",
"target_port_label": "16100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_health \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16100,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-health",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Benign Health",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 16100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe health \u00b7 via HTTP:16100 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:16100\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"target_port_label": "16100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
8076 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8076 · (reconnaissance) · → /health
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8076
Chemin / cible
/health
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +4
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:8076
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br, z
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:8076 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "51351cf6517830208be4516a400b0f1c881839c2",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.143022268337151,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 8076,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "2af0b88e26b4cee23f582f518af7bf5635dfd14d",
"event_fingerprint": "05e4d830d8cc6a6bd0618dfb597735f68c95c699",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 4
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "e445678669d00623de8bf8b928514e5e",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 8076,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2358b9d48a41313f21dfcdfc7ca870e235faf88b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8076,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"attack_vector": "port scan syn \u00b7 via HTTP:8076 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"target_port_label": "8076 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 4
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8076,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8076,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8076 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8076\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"target_port_label": "8076 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +4",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8076"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 30,
"behavior_alerts": [
"rapid_port_scan"
],
"correlation_confidence_boost": 4,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
22000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:22000 · (reconnaissance) · → /health
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
22000
Chemin / cible
/health
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:22000
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br,
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:22000 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "a153e5f72c04e8a17b3da8f4103e06403af160cb",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.102780103392835,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 22000,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "45c4e6aeb4e48a3a638c29f08c251a435233914c",
"event_fingerprint": "ab2d2401db5190bde1a915d6cd32b44bcafa1478",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "cf6846f19453cfbf1fc9e90da95fa499",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 22000,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, ",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8970b8d8424de1e04b729be9980b15783ac464d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 22000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"attack_vector": "port scan syn \u00b7 via HTTP:22000 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"target_port_label": "22000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 22000,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 22000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:22000 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:22000\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"target_port_label": "22000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "22000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
8076,
16100,
18049,
22000
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 40,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
8024 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8024 · (reconnaissance) · → /health
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8024
Chemin / cible
/health
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:8024
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br, z
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:8024 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "16abed6f1c6c78464861e2240eaf23de55acf579",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.137430509061866,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 8024,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "9b4613509438d4d09ed1b9f873f8d107ff14a0e3",
"event_fingerprint": "9a0c2553babdb5fc9bb32d44f41a095f9ee8f4db",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "34184660cbd96662042990c6ccf7f14d",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 8024,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "050986478db677e0dc72e96bd874ffd9ea2c6692",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8024,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"attack_vector": "port scan syn \u00b7 via HTTP:8024 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"target_port_label": "8024 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8024,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8024,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8024 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8024\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"target_port_label": "8024 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
8024,
8076,
16100,
18049,
22000
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 50,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
3160 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3160 · (reconnaissance) · → /health
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3160
Chemin / cible
/health
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:3160
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br, z
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:3160 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "2ed477da899e82f66276bb76f09136174338ef7d",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.109761342443276,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 3160,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "aa0707311d85e4b0836a2d2d24ad318180831cad",
"event_fingerprint": "1f81a0d3d9430ef493e00cdf8b9bc5d90f639eca",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "1886dd113c39708c05cd2d0fdcf46707",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 3160,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e126940819328191d85035d0357c1f3cd9d19e1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3160,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"attack_vector": "port scan syn \u00b7 via HTTP:3160 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"target_port_label": "3160 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3160,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 3160,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3160 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:3160\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"target_port_label": "3160 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3160"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
3160,
8024,
8076,
16100,
18049,
22000
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 60,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
12281 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:12281 · (reconnaissance) · → /health
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12281
Chemin / cible
/health
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:12281
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br,
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:12281 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "b8b067432788d318070430ef43923cc20e0f68c8",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.108330746791097,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 12281,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "8ffa2c20bd5bc621f79475782e225ad475c4f58b",
"event_fingerprint": "08dd5c78c23ca6f44b6f76073a646260509d77eb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "4c1550fc3c957baefaaf989046795b97",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 12281,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, ",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf4e3cf84ea8734fcffd6379c827933e41a20648",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 12281,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"attack_vector": "port scan syn \u00b7 via HTTP:12281 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"target_port_label": "12281 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12281,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 12281,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:12281 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:12281\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br,",
"target_port_label": "12281 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12281"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
3160,
8024,
8076,
12281,
16100,
18049,
22000
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 70,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|
|
|
TCP |
8575 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8575 · (reconnaissance) · → /health
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
GET /health UA python-httpx/0.28.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_health
Cible HTTP
GET
/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8575
Chemin / cible
/health
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Sigma httpx tool
UA httpx
Ligne de requête
GET /health HTTP/1.1
User-Agent
python-httpx/0.28.1
Règles WAF
—
Payload (extrait)
GET /health HTTP/1.1
Host: 62.3.50.33:8575
User-Agent: python-httpx/0.28.1
Accept: */*
Accept-Encoding: gzip, deflate, br, z
Requête brute (extrait)
GET /health HTTP/1.1 Host: 62.3.50.33:8575 User-Agent: python-httpx/0.28.1 Accept: */* Accept-Encoding: gzip, deflate, br, zstd
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
"http_host_hash": "d5667348204d04a272d429aef58e3caa2384f632",
"http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.143022268337151,
"port_category": "registered",
"org": "Telstra Global",
"service": "http",
"app_proto": "http",
"asn": 4637,
"country": "TW",
"dst_port": 8575,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "7b834ed28a21b0b4fe41c06017975e618f8c26ed",
"event_fingerprint": "ee8bc5095f731a5d95a42013028afe2431a79146",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0596",
"pat-0439"
],
"matched_pattern_names": [
"Sigma httpx tool",
"UA httpx"
],
"pattern_ids": [
"pat-0596",
"pat-0439"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 4637,
"org": "Telstra Global",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
"payload_hash": "d8f9a91e762f8cded6552309ed6492c8",
"path_pattern_hash": "0587c50e302cd55b995100e6e49c0789"
},
"target_context": {
"dst_port": 8575,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"evidence": {
"method": "GET",
"path": "\/health",
"user_agent": "python-httpx\/0.28.1",
"request_line": "GET \/health HTTP\/1.1",
"request_sample": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, zstd\r\n\r\n",
"payload_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50cb41001018e306efdb63398bec0ce59fdaeb28",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8575,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"attack_vector": "port scan syn \u00b7 via HTTP:8575 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"target_port_label": "8575 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8575,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/health",
"request_line": "GET \/health HTTP\/1.1",
"http_user_agent": "python-httpx\/0.28.1",
"port": 8575,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8575 \u00b7 (reconnaissance) \u00b7 \u2192 \/health",
"evidence_snippet": "GET \/health HTTP\/1.1\r\nHost: 62.3.50.33:8575\r\nUser-Agent: python-httpx\/0.28.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip, deflate, br, z",
"target_port_label": "8575 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8575"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
3160,
8024,
8076,
8575,
12281,
16100,
18049,
22000
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 80,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_health"
]
}
|