Fiche IP

Bulgarie

93.123.109.124

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via PERSONAL AGENT — multi-protocole (839 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

FAI Techoff Srv Limited Première vue 27/10/2026 08:00 UTC Dernière vue 27/10/2026 09:31 UTC Risque Moyen

Période 2026-10-03 → 2026-11-02

Moyen 55/100

24h 7j 30j 90j

Synthèse

Score de risque max. 55/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 27/10/2026 08:00 UTC

Dernière observation 27/10/2026 09:31 UTC

Événements (période) 1,799

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 1734 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +23

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

55/100 Confiance 100 % 1,799 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 93.123.109.124
Décision : Investiguer
Score max : 55/100 (Moyen)
Confiance : 100 %
Période : 2026-10-03 → 2026-11-02 · 1799 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 100%
MITRE : T1046
FAI : Techoff Srv Limited · Bulgarie

Comparaison ASN / FAI

ASN 48090 · 93.123.109.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1,799 événements sur la période pour cette IP.

45.148.10.238 Traversal LFI 01/11/2026 18:12 UTC
195.178.110.50 Sonde fichier configuration 29/10/2026 18:36 UTC
93.123.109.214 Tentative d'exploit 26/10/2026 12:24 UTC
45.148.10.125 Sonde fichier configuration 23/10/2026 05:02 UTC
45.148.10.151 Sonde SSH 22/10/2026 15:36 UTC
195.178.110.204 Injection PHP 22/10/2026 14:39 UTC
45.148.10.152 Sonde SSH 22/10/2026 14:37 UTC
45.148.10.141 Sonde SSH 22/10/2026 14:32 UTC

Événements (filtres)

1,799

Première observation

27/10/2026 08:00 UTC

Dernière observation

27/10/2026 09:31 UTC

Dernière activité (filtres)

27/10/2026 09:31 UTC

Événements 7j

1,799

Ports distincts (7j)

926

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 700 HTTP TCP 123 RDP TCP 5 HTTPS TCP 5 ELASTICSEARCH TCP 4 COUCHBASE TCP 4 WINRM TCP 4 WEBLOGIC CLUSTER TCP 3 SMB TCP 3 CLOUDFLARE TUNNEL TCP 3 HDFS NAMENODE TCP 3 POSTGRES TCP 3 VNC TCP 3 SAP Diag TCP 3 ETCD TCP 3 SMTP ALT TCP 3 WEBLOGIC SSL TCP 2 PROFINET IO TCP 2 RPCBIND TCP 2 FCM SSL TCP 2

TLS

700

HTTP

123

RDP

HTTPS

ELASTICSEARCH

COUCHBASE

Géolocalisation

Origine réseau déclarée

Bulgarie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Techoff Srv Limited 0 Port 11434 Scan de ports

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via PERSONAL AGENT:5555 · (reconnaissance)

Détails protocole

Port / service

5555 · PERSONAL AGENT

Service émulé

PERSONAL-AGENT

Raison confiance

Confiance 100 % — 1 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

1,799 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1799 événement(s) — page 2/72

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/10/2026 09:31:47 UTC	TCP	7510 · TLS	tls	Scan de ports port scan syn · via TLS:7510 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7510 Chemin / cible — Service TLS Payload {w��\|�F��bD+5��b3k��p4��d_�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��\|�F��bD+5��b3k��p4��d_�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.841809561543816,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7510,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":2.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"d6f6a58e856a6c448de6c3c0dca098063d434838","event_fingerprint":"5b3bd1f6d509c95d7aa2e31d3f8a11d97c5a3453","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7080 · TLS	tls	Scan de ports port scan syn · via TLS:7080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7080 Chemin / cible — Service TLS Payload {w��ȁЇ�3��G'6��F�y��1��y�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��ȁЇ�3��G'6��F�y��1��y�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.914037002933164,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7080,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"1a4f7b8864c17d37faed79a97f53e0218b855b74","event_fingerprint":"cb2002c608c5795c2ee9e361e5ef736fc787a8c8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7777 · GAME UNREAL	game-unreal	Scan de ports port scan syn · via GAME UNREAL:7777 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur GAME-UNREAL WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7777 Chemin / cible — Service GAME UNREAL Payload {w��B\|�ʏ>W��ci��84�Pe�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��B\|�ʏ>W��ci��84�Pe�/�+�� /5� 4 � Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a","emulator_response_len":42,"bytes_in":128,"payload_entropy":4.868403769891415,"port_category":"registered","org":"Techoff Srv Limited","service":"game-unreal","app_proto":"game-unreal","asn":48090,"country":"BG","dst_port":7777,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"8d5ae373e75af6868d8ed2e6b390af0856fff91e","event_fingerprint":"d1d5eef058c01dc28b25edac05bf96e96a6b749c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"game-unreal","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_data…
27/10/2026 09:31:47 UTC	TCP	7773 · TLS	tls	Scan de ports port scan syn · via TLS:7773 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7773 Chemin / cible — Service TLS Payload {w��D�ָ�b��T��+~A��fK)?��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��D�ָ�b��T��+~A��fK)?��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.851537002933164,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7773,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"4b9ea601e443e322c1eb2adf541aa676ab45614a","event_fingerprint":"afc6682620f54ed95206a20da5b1747c808c5956","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7022 · TLS	tls	Scan de ports port scan syn · via TLS:7022 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7022 Chemin / cible — Service TLS Payload {w��9�<��9�Y�I��'� }�}n��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��9�<��9�Y�I��'� }�}n��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.851537002933164,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7022,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"03c3162f10a92d0ea15400553d799b7f87f681e5","event_fingerprint":"26a1601cf0b467ae05353ac8e7e035b0be09e2a7","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191ef…
27/10/2026 09:31:47 UTC	TCP	7403 · TLS	tls	Scan de ports port scan syn · via TLS:7403 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7403 Chemin / cible — Service TLS Payload {w�icW��3f�G�4E��(f��+\�oL��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�icW��3f�G�4E��(f��+\�oL��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.8515370029331635,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7403,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"6ec9d74d05d972f04ac2677ed646a5bafc2533b9","event_fingerprint":"787a250c5bd8606c709047aa331ecb3d48e93815","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	7084 · TLS	tls	Scan de ports port scan syn · via TLS:7084 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7084 Chemin / cible — Service TLS Payload {w��-WL�Gh��Y��X ��a Q��:#j�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��-WL�Gh��Y��X ��a Q��:#j�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.835912002933164,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7084,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"c6cf72eb60067710b10c5dd17db2d81a45dd56e5","event_fingerprint":"0a7b8964d0eaec7a95cda5fa99c0a586de3597b8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191ef…
27/10/2026 09:31:47 UTC	TCP	7013 · TLS	tls	Scan de ports port scan syn · via TLS:7013 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7013 Chemin / cible — Service TLS Payload {wlO�?;D��X��~8�Ig�-&']�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {wlO�?;D��X��~8�Ig�-&']�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.844859245337278,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7013,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"c057120bf5a9a9454104849b03659b3f2ff3e577","event_fingerprint":"9953441b28b130ec29c8a482d26a12b46b35df0d","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7474 · NEO4J HTTP	neo4j-http	Scan de ports port scan syn · via NEO4J HTTP:7474 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur NEO4J-HTTP WAF — Recommandation Surveiller Tags neo4j_http_emulated neo4j_http_payload net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7474 Chemin / cible — Service NEO4J HTTP Payload {wϞVפ(��K�r��ը&>�#�Pm(�:�U��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {wϞVפ(��K�r��ը&>�#�Pm(�:�U��/�+�� /5� 4 � Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206e656f346a5f6874747020726561647920706f72743d373437340d0a","emulator_response_len":41,"bytes_in":128,"payload_entropy":4.898412002933164,"port_category":"registered","org":"Techoff Srv Limited","service":"neo4j-http","app_proto":"neo4j-http","asn":48090,"country":"BG","dst_port":7474,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"de5117d0f779915e28c8ace13add8f8878355feb","event_fingerprint":"567b5a7b5228f3d7fb85dff2966ccc2eba4ea747","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"neo4j-http","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacen…
27/10/2026 09:31:47 UTC	TCP	7071 · TLS	tls	Scan de ports port scan syn · via TLS:7071 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7071 Chemin / cible — Service TLS Payload {w�l�5r�l�-G�K}�y�y�~ͪ�M4P�'�m�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�l�5r�l�-G�K}�y�y�~ͪ�M4P�'�m�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.867162002933164,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7071,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"eca2b20a22a66c67a25a6f371ea64993bbcb86f7","event_fingerprint":"1a3b4e8765de1a4cabbe2be8c44e560bd3f97aad","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7020 · TLS	tls	Scan de ports port scan syn · via TLS:7020 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7020 Chemin / cible — Service TLS Payload {w��vp�F�^�:��-`��y�}ly�9��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��vp�F�^�:��-`��y�}ly�9��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.857434561543816,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7020,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"ecd8b87c6484fff37bdb0e76f61a77f3f07482cd","event_fingerprint":"266144abe9aba0403e7e137357d20923165dac2f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7081 · TLS	tls	Scan de ports port scan syn · via TLS:7081 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7081 Chemin / cible — Service TLS Payload {wa�g�#��pɏ[��X�1h�M�!�nj�5��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {wa�g�#��pɏ[��X�1h�M�!�nj�5��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.760403980465638,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7081,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"dee5161e6e44360e305e68d46c9b2c244f40b39b","event_fingerprint":"47f238a6cfc56539faf2ee1bb3e86f4a5200a58c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7078 · TLS	tls	Scan de ports port scan syn · via TLS:7078 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7078 Chemin / cible — Service TLS Payload {w�Zc #��&o�nɱY�D��]��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�Zc#��&o�nɱY�D��]��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.690127392872304,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7078,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"59004ddcb99a24f185c25a732f48736679e73d59","event_fingerprint":"b978ad4f0215b49b4c0f14a4f2ce3f2e3f958428","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191ef…
27/10/2026 09:31:47 UTC	TCP	7102 · TLS	tls	Scan de ports port scan syn · via TLS:7102 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7102 Chemin / cible — Service TLS Payload {w�oӅvζt�Hlᯆ��g��tw}��p��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�oӅvζt�Hlᯆ��g��tw}��p��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.843051328502067,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7102,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"d08fc56a6080e0f4850a55f820cd99ba83aead64","event_fingerprint":"889c244577141dbdb2e1757a014e68b813e7443a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7771 · TLS	tls	Scan de ports port scan syn · via TLS:7771 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7771 Chemin / cible — Service TLS Payload {w�q�m�3��l��S�� T}4N�`E��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�q�m�3��l��S��T}4N�`E��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.811108863244334,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":7771,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"ce3dcd9c9d94e5041b817b14366f6b8d6c852823","event_fingerprint":"99790ff009182d348a4f1461b33472d233001fe8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7014	—	Scan de ports port scan syn · port 7014 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7014 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7014,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"51539fe693ca616b404ef5d3d6022aa7a3d8abd6","event_fingerprint":"de4a080155bcefb8d5046961eb853f575a743dc3","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7014,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7100	—	Scan de ports port scan syn · port 7100 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7100 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7100,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"ad85ffaf983d22265a4f58a0be2d68c30819be95","event_fingerprint":"08cc422187f7540a46c99fa47b619908be1bf245","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7100,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7087	—	Scan de ports port scan syn · port 7087 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7087 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7087,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"9dac31d152825fa7b39e21ecdf5ce8993372ff71","event_fingerprint":"69b32703538d37a67b58f8484c00bd1fcbe11cb4","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7087,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7105	—	Scan de ports port scan syn · port 7105 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7105 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7105,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"5180809dd0166d88cdc3d4e074f0ded68fc533a9","event_fingerprint":"a474997fb7dcf8e520eeb9132e4c4e5e9a92c4af","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7105,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7170	—	Scan de ports port scan syn · port 7170 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7170 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7170,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"b7db53f5ce0396cabfa5851a6651d5121500f579","event_fingerprint":"8d0883adea576882df0bf85588007a853bdc1232","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7170,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7025	—	Scan de ports port scan syn · port 7025 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7025 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7025,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"5c730a224e1604d4c27a7501fced37d9dfcbbf8a","event_fingerprint":"0d4899bcaf34d3c67fe102d535a5575daa4f4a6b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7025,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7272	—	Scan de ports port scan syn · port 7272 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7272 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7272,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"8bd03dd99f8d869efb50337c7e6b0223f6e0119c","event_fingerprint":"cde41bfe93d439870cca9ae7f1039ecfbc4fa518","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7272,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7010	—	Scan de ports port scan syn · port 7010 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7010 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7010,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"a2fb19f72b9a7e0753f757da98669b4b57701eaa","event_fingerprint":"386d67ff7acf928bbfc91f74ec6e1ce7789d76ce","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7010,"risk_score":42},"payload_preview":" \n…
27/10/2026 09:31:47 UTC	TCP	7171	—	Scan de ports port scan syn · port 7171 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7171 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7171,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"c94c0a2d8318fc4d7d6fb2e5348efa386de2a949","event_fingerprint":"de4db302e268ef9fbd375688b96af7b8917d111e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7171,"risk_score":42},"payload_preview":" \n…
27/10/2026 09:31:47 UTC	TCP	7218	—	Scan de ports port scan syn · port 7218 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7218 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7218,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"f2d4dc2b47af376198a2775122738c35f3a5058a","event_fingerprint":"77b9b73b8bf0e0d919dc26ba027aa8ddaae439bf","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7218,"risk_score":42},"payload_preview":" …

93.123.109.124

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence