Fiche IP

Bulgarie

93.123.109.204

Activité suspecte · risque 48/100

FAI Techoff Srv Limited Première vue 11/10/2026 10:08 UTC Dernière vue 14/10/2026 16:24 UTC Risque Moyen

Période 2026-10-08 → 2026-10-15

Moyen 48/100

24h 7j 30j 90j

Synthèse

Score de risque max. 48/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 11/10/2026 10:08 UTC

Dernière observation 14/10/2026 16:24 UTC

Événements (période) 1,040

MITRE ATT&CK principal T1046 981 occurrences

Pourquoi listée

Négociation protocole RDP · confiance 95%

Confiance 95 % — Score WAF 8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

48/100 Confiance 95 % 1,040 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC

Note de ticket

IP 93.123.109.204
Décision : Investiguer
Score max : 48/100 (Moyen)
Confiance : 95 %
Période : 2026-10-08 → 2026-10-15 · 1040 événements
Motif : Négociation protocole RDP · confiance 95%
DNSBL : 204.109.123.93.dnsbl.blacklistip.com → 127.0.0.3 (Sonde RDP)
MITRE : T1046
FAI : Techoff Srv Limited · Bulgarie

Comparaison ASN / FAI

ASN 48090 · 93.123.109.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1,040 événements sur la période pour cette IP.

45.148.10.151 Sonde SSH 15/10/2026 01:37 UTC
93.123.109.226 Sonde PostgreSQL 15/10/2026 01:31 UTC
45.148.10.152 Sonde SSH 15/10/2026 01:31 UTC
195.178.110.204 Injection PHP 15/10/2026 01:16 UTC
45.148.10.61 Sonde port 15/10/2026 01:14 UTC
93.123.109.6 Sonde PPTP 14/10/2026 23:06 UTC
195.178.110.237 Sonde SSH 14/10/2026 21:59 UTC
195.178.110.232 Sonde SSH 14/10/2026 20:08 UTC

Événements (filtres)

1,040

Première observation

11/10/2026 10:08 UTC

Dernière observation

14/10/2026 16:24 UTC

Dernière activité (filtres)

14/10/2026 16:24 UTC

Événements 7j

1,040

Ports distincts (7j)

970

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

RDP TCP 14 SAP Diag TCP 13 SAP MS TCP 12 DOCKER TLS TCP 2 HTTP ALT 8006 TCP 1 STUN TCP 1 SOCKS5 TCP 1 WINRM TCP 1 DISCORD WEBHOOK TCP 1 MARIADB TCP 1 BITTORRENT TRACKER TCP 1 SIP TCP 1 TERADATA TCP 1 WEBLOGIC CLUSTER TCP 1 IRC TCP 1 KDM TCP 1 JETDIRECT TCP 1 CITRIX ICA WF TCP 1 IRC ALT TCP 1

RDP

SAP Diag

SAP MS

DOCKER TLS

HTTP ALT 8006

STUN

Géolocalisation

Origine réseau déclarée

Bulgarie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Techoff Srv Limited 0 Port 3389 Sonde RDP

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

rdp probe · via RDP:3389 · (sonde / probe)

Détails protocole

Aperçu payload

�

Port / service

3389 · RDP

Service émulé

RDP

Raison confiance

Confiance 95 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0348

Confiance

95%

Famille de menace

scanner IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

1,040 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1040 événement(s) — page 2/42

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/10/2026 16:06:16 UTC	TCP	6635	—	Scan de ports port scan syn · port 6635 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6635 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":6635,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"7cc47135e15fe52192f8ca9b9b9b4c99faf34e0a","event_fingerprint":"3019d0b8069f6f8344d81ecf2798542db573eb8f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:06:13 UTC	TCP	3612 · SAP Message Server	sap-ms	Scan de ports port scan syn · via SAP Message Server:3612 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-MS WAF — Recommandation Surveiller Tags net_port_scan_slow sap_message_server Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3612 Chemin / cible — Service SAP Message Server Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":"sap-ms","app_proto":"sap-ms","asn":48090,"country":"BG","dst_port":3612,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":38,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":38,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"1694694bba927b1e9ca3a7bd79356990884d0264","event_fingerprint":"9164298af1f4cc3670387c56392a44c4210f276c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":38,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"service_name":"sap-ms","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"B…
14/10/2026 16:06:10 UTC	TCP	2747	—	Scan de ports port scan syn · port 2747 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2747 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":2747,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"802e7ec9b95e3651d16324eece1f8774f8fca4bc","event_fingerprint":"ff467800a2fd44fb746b0039833cb6f8e525d312","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:06:09 UTC	TCP	9052	—	Scan de ports port scan syn · port 9052 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9052 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":9052,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"6b0cdcd6f6b1405b2e48c238b7ee9f4a4e5691cb","event_fingerprint":"7bb2000e6035ed62cc5c7e8c853edabffc9c4c0c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:06:05 UTC	TCP	9088	—	Scan de ports port scan syn · port 9088 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9088 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":9088,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"66cb41cf68837735aa9ece2b7ad28c56395bdf37","event_fingerprint":"97f4e38237ad5bd2a3b6c8a99a06463a75ab0ca2","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:06:02 UTC	TCP	6180	—	Scan de ports port scan syn · port 6180 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6180 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":6180,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e911cb08eb2a84ea2c745fe73baa5e91b79991cd","event_fingerprint":"fd42fb8df82b2077822fdf274aec9ea69913ac0a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:59 UTC	TCP	9471	—	Scan de ports port scan syn · port 9471 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9471 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":9471,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"cf49dad13c6353aba57af725de8491b3a093e087","event_fingerprint":"186935bfac4c56d3f739a84290fea51e8dec17ec","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:58 UTC	TCP	3470	—	Scan de ports port scan syn · port 3470 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3470 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":3470,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"8294d9d4d10788a1a670b7f3590f52c49accdb5c","event_fingerprint":"8bbeec71ba33eb47153e849939ef9a9fc17ab450","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Lim…
14/10/2026 16:05:54 UTC	TCP	6789	—	Scan de ports port scan syn · port 6789 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6789 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":6789,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"299e4fe680a3ecc014c5f7e96a9e3de082366134","event_fingerprint":"d58b8da2eed5aa897c0916c4d4190ba624ef1b9b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:54 UTC	TCP	2598 · CITRIX ICA WF	citrix-ica-wf	Scan de ports port scan syn · via CITRIX ICA WF:2598 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur CITRIX-ICA-WF WAF — Recommandation Surveiller Tags citrix_ica citrix_ica_wf_emulated citrix_ica_wf_payload net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2598 Chemin / cible — Service CITRIX ICA WF Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"494341000000004369747269782049434120536572766963650d0a","emulator_response_len":27,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":"citrix-ica-wf","app_proto":"citrix-ica-wf","asn":48090,"country":"BG","dst_port":2598,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"5f02f63789c1bc54d71aeda9bc6b87513c7cbc1b","event_fingerprint":"5c4168fa93c1ac1b31121d75c036951f9ca8dfe5","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classificatio…
14/10/2026 16:05:52 UTC	TCP	1848	—	Scan de ports port scan syn · port 1848 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1848 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":1848,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"dbfebdfafa014ea411a31b2ef92a27356187ed8c","event_fingerprint":"aa516e1acc5858fc13092a4ac3034b02752ab1a8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:48 UTC	TCP	5517	—	Scan de ports port scan syn · port 5517 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5517 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":5517,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"29577caa86a5977af22e6828dece130cbcf16fe6","event_fingerprint":"6a1065366131da373b79d596452b95d821f53943","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:47 UTC	TCP	3234 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3234 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags net_port_scan_slow sap_diag_emulated sap_diag_payload sap_diag_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3234 Chemin / cible — Service SAP Diag Payload � Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"00000000534150000000000000000000000000","emulator_response_len":19,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":"sap-diag","app_proto":"sap-diag","asn":48090,"country":"BG","dst_port":3234,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":38,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":38,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"35a5cb02d59baa236521e72484015cabb5cb95bb","event_fingerprint":"c1ef6149c1f506a04dbcfb453e9dc839f393a774","classification_reason":"Connexion SAP Diag\/GUI \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":38,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"service_name":"sap-diag","risk_confidence_f…
14/10/2026 16:05:26 UTC	TCP	6168	—	Scan de ports port scan syn · port 6168 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6168 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":6168,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"2fe914eb33192844e4bf05fee4ed8f3adcff65eb","event_fingerprint":"ac03c7e43dcd655954d25081739cbbe0c289d600","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:26 UTC	TCP	4037	—	Scan de ports port scan syn · port 4037 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4037 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":4037,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"9ff686fd27cd739e366a93c063fe87717e9da55d","event_fingerprint":"c868e231321beec02c4bc8bd2f9224c1ba4c3597","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:19 UTC	TCP	9105	—	Scan de ports port scan syn · port 9105 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9105 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":9105,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"1efc1c8a2bd72d1a8dfb16617be2e89b30a6bf66","event_fingerprint":"b82e68dc0cb891d7926c057d380ecafee53fe0eb","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:17 UTC	TCP	1855	—	Scan de ports port scan syn · port 1855 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1855 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":1855,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"8c01f565b062d04ea46fb011a15085632365d559","event_fingerprint":"3d7a0d5fef3c1db0e507a6a36a22b4dfb2f62fc7","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:14 UTC	TCP	8128	—	Scan de ports port scan syn · port 8128 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8128 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":8128,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"ed84f2b5a1fc8565601de5f8686ad0450d403530","event_fingerprint":"08a63207301ddc4c158369825d30ef1c7492e518","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:07 UTC	TCP	3228 · SAP Diag	sap-diag	Scan de ports port scan syn · via SAP Diag:3228 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags net_port_scan_slow sap_diag_emulated sap_diag_payload sap_diag_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3228 Chemin / cible — Service SAP Diag Payload � Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"00000000534150000000000000000000000000","emulator_response_len":19,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":"sap-diag","app_proto":"sap-diag","asn":48090,"country":"BG","dst_port":3228,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":38,"risk_novelty":0,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":38,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"bb67a2e28c8117f6ab173a068821b7425d6ed8c2","event_fingerprint":"d3e55613e356219439dbf0012ceb74171ba11e76","classification_reason":"Connexion SAP Diag\/GUI \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":38,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"service_name":"sap-diag","risk_confidence_f…
14/10/2026 16:05:04 UTC	TCP	4573	—	Scan de ports port scan syn · port 4573 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4573 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":4573,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"7e20687e23f079edf6ebe2414ca49f115931ff55","event_fingerprint":"fa917899e90f748fb33ce6ddd61b388bbff8ae1d","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:05:00 UTC	TCP	4482	—	Scan de ports port scan syn · port 4482 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4482 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":4482,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"496f6d96e3eeeb1caa7d9210b7d0578791d93bdf","event_fingerprint":"d51b9712211eb11e69a440a325afd425ac2ce247","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:04:55 UTC	TCP	6692	—	Scan de ports port scan syn · port 6692 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6692 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":6692,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"eb467e618949af3b774c8c63648d674325fc262a","event_fingerprint":"4da1252ace888f553dbb1a3f2b6d6aab61b27055","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:04:54 UTC	TCP	9035	—	Scan de ports port scan syn · port 9035 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9035 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":9035,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"c9e2f4bbe7af6269e108d23ac6e8e8374c8571e2","event_fingerprint":"1e12ac6b122f23d96a8292e650b7efdeecb86f97","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv L…
14/10/2026 16:04:51 UTC	TCP	3817	—	Scan de ports port scan syn · port 3817 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3817 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":3817,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"270f2de490d35f46a442c66bc3ead9e77690277a","event_fingerprint":"7d5d30b14671b0f1dfb60c07ef824ebfbf76699a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Lim…
14/10/2026 16:04:48 UTC	TCP	8331	—	Scan de ports port scan syn · port 8331 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8331 Chemin / cible — Payload � Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":8331,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e5be55c08a25ede09e43d00626fd99958bbfb7f6","event_fingerprint":"57ea956765a8571bca2a9fa9feb6153a86e5356f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Lim…

93.123.109.204

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence