|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.222.140.50:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.222.140.50:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 63,
"payload_entropy": 4.744760233154764,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58759936be390431371c0167a17d69af",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "733dd8db066d82bf387b496bd25a0c086286f8e0",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.195.40.238:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.195.40.238:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 63,
"payload_entropy": 4.8202346379510095,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a17d1dd8bc29ec51040ed0dda8622d57",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "339b11050edd15434144282c6f4536e9341f0ec3",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.222.140.50:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.222.140.50:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 63,
"payload_entropy": 4.744760233154764,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58759936be390431371c0167a17d69af",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "733dd8db066d82bf387b496bd25a0c086286f8e0",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT we-love-the.world:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT we-love-the.world:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 67,
"payload_entropy": 4.57879455625263,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3fdc7c20e114ad1340e061e8ec176d50",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f257e0e1d7f96ea51719a4f64026c7d5bab4028",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT we-love-the.world:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT we-love-the.world:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 67,
"payload_entropy": 4.57879455625263,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3fdc7c20e114ad1340e061e8ec176d50",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f257e0e1d7f96ea51719a4f64026c7d5bab4028",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
77%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.77,
"classification_confidence": 0.77,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
77%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.77,
"classification_confidence": 0.77,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
77%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.77,
"classification_confidence": 0.77,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.222.140.50:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.222.140.50:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 63,
"payload_entropy": 4.744760233154764,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58759936be390431371c0167a17d69af",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "733dd8db066d82bf387b496bd25a0c086286f8e0",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.195.40.238:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.195.40.238:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 63,
"payload_entropy": 4.8202346379510095,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a17d1dd8bc29ec51040ed0dda8622d57",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "339b11050edd15434144282c6f4536e9341f0ec3",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.222.140.50:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.222.140.50:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 63,
"payload_entropy": 4.744760233154764,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58759936be390431371c0167a17d69af",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "733dd8db066d82bf387b496bd25a0c086286f8e0",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT we-love-the.world:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT we-love-the.world:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 67,
"payload_entropy": 4.57879455625263,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3fdc7c20e114ad1340e061e8ec176d50",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f257e0e1d7f96ea51719a4f64026c7d5bab4028",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT we-love-the.world:443 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT we-love-the.world:443 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 67,
"payload_entropy": 4.57879455625263,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3fdc7c20e114ad1340e061e8ec176d50",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f257e0e1d7f96ea51719a4f64026c7d5bab4028",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 7,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.195.40.238:80 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.195.40.238:80 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 62,
"payload_entropy": 4.822922673493043,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b869f934f5a2769a626751f1e2ef38d3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72610a648370d8d3e3df69d5aaa55216938b98f2",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.222.140.50:80 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.222.140.50:80 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 62,
"payload_entropy": 4.734055334713576,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7010fdad0a7612b6fd7c8f9e4878ca5b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f827346ae2af9c122b1f5f0c8b413b4573c959b6",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.222.140.50:80 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.222.140.50:80 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 62,
"payload_entropy": 4.734055334713576,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7010fdad0a7612b6fd7c8f9e4878ca5b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f827346ae2af9c122b1f5f0c8b413b4573c959b6",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT 51.195.40.238:80 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 51.195.40.238:80 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 62,
"payload_entropy": 4.822922673493043,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b869f934f5a2769a626751f1e2ef38d3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72610a648370d8d3e3df69d5aaa55216938b98f2",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT we-love-the.world:80 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT we-love-the.world:80 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 66,
"payload_entropy": 4.564867748271415,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6a2ee3d88dc3b8819168dd881bf5ab00",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b86392f44acb421cfc751d3f47c0228cc06edfbb",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT we-love-the.world:80 HTTP/1.1 Host: we-love-the.world
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
59%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT we-love-the.world:80 HTTP/1.1
Host: we-love-the.world
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 66,
"payload_entropy": 4.564867748271415,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6a2ee3d88dc3b8819168dd881bf5ab00",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"request_sample": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"evidence": {
"request_sample": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world\r\n\r\n",
"payload_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b86392f44acb421cfc751d3f47c0228cc06edfbb",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT we-love-the.world:80 HTTP\/1.1\r\nHost: we-love-the.world",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
77%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.77,
"classification_confidence": 0.77,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
77%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.77,
"classification_confidence": 0.77,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
77%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.77,
"classification_confidence": 0.77,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
�3ތ2
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fa7aa61033535afa526dd888eb4db7dc",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0dc89c1c81003537abba78ad789d4fa8af9a70ba",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd3\u078c2",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd3\u078c2",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
�3�(�
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ea9fdabe5c0655ede7326703b196bd27",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa9543447a931ab2dc79f0913f2846c67fac90d3",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd3\ufffd(\ufffd",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd3\ufffd(\ufffd",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
�3ތ2
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fa7aa61033535afa526dd888eb4db7dc",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0dc89c1c81003537abba78ad789d4fa8af9a70ba",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd3\u078c2",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd3\u078c2",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
�3�(�
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ea9fdabe5c0655ede7326703b196bd27",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa9543447a931ab2dc79f0913f2846c67fac90d3",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd3\ufffd(\ufffd",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd3\ufffd(\ufffd",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_745445acf1e3a418 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_745445acf1e3a418 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_745445acf1e3a418 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.4733836873282735,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7d58505e64e0c53dc1a42e2b82d87303",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0eceb8077d01d5a00b5406b4a1ccb00740f0cd5",
"protocol_details": {
"payload_preview": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_745445acf1e3a418 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_ea7c45a627fb39c6 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_ea7c45a627fb39c6 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_ea7c45a627fb39c6 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.483476475198981,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "54b2ca116ccfd579b0946066ac8e46a3",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b41f708c3f7c37963eefc3b1e5c276f35fdc8300",
"protocol_details": {
"payload_preview": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_ea7c45a627fb39c6 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_3310e3d8f1998cc3 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_3310e3d8f1998cc3 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_3310e3d8f1998cc3 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.4778246698764175,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2be03f9530b324b7260a094680286024",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d54e62029ce6286938237c27240ba3d3389c4fe0",
"protocol_details": {
"payload_preview": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_3310e3d8f1998cc3 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_a8e6d5bd71d8ee61 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_a8e6d5bd71d8ee61 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_a8e6d5bd71d8ee61 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.472787940589465,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1d73fada0617c10c42f0a38ce514c349",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53153d396b6ed8b344e93cee4ebdc26d2464187f",
"protocol_details": {
"payload_preview": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_a8e6d5bd71d8ee61 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_afe16b53f2c07887 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_afe16b53f2c07887 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_afe16b53f2c07887 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.491477929655183,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba6b5a6ee8f5478f710509c1418517f9",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42caf1100695203c323048410ec1b523cb5782f4",
"protocol_details": {
"payload_preview": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_afe16b53f2c07887 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_818d68993adaef8e HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_818d68993adaef8e HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_818d68993adaef8e HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.476382489491702,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a91adc25b06926de1143083ee4d67e97",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff91544bf76aee24bff98c8dec2215dedaa15783",
"protocol_details": {
"payload_preview": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_818d68993adaef8e HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_c7ce4a6de0c0b003 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_c7ce4a6de0c0b003 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_c7ce4a6de0c0b003 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.453988785644896,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "84a8613c7864070fe77b24fad9e9e9a0",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1bd381bbe6abbb7b8ad898ecc257fd4ffa18cc20",
"protocol_details": {
"payload_preview": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_c7ce4a6de0c0b003 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_17c01b25be0938a8 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_17c01b25be0938a8 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_17c01b25be0938a8 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.4892431301901485,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ab32f94670beaaa0977473e68e439ea9",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a929d014e652da480a74e6178deb7e3bf676fd6d",
"protocol_details": {
"payload_preview": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_17c01b25be0938a8 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_7b353f44448a16a9 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_7b353f44448a16a9 HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_7b353f44448a16a9 HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.48885649045562,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a3270284b6bfd7705b73394d5d98fd8",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22fa022d83cb476b96d7a437a9ea18019429f22a",
"protocol_details": {
"payload_preview": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_7b353f44448a16a9 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_44d758f425e7d05a HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_44d758f425e7d05a HTTP/1.1
Host: make-internet-safer-for-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /check_44d758f425e7d05a HTTP/1.1 Host: make-internet-safer-for-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 425,
"payload_entropy": 5.493213578553027,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9b78f18f1b77b12940b8b6ca108f82cd",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"request_sample": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/",
"payload_snippet": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a767cb8c769bf3ea8a8f07a329dfc5d2db3264c5",
"protocol_details": {
"payload_preview": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_44d758f425e7d05a HTTP\/1.1\r\nHost: make-internet-safer-for-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
��C�c
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df8005337761b32b101374e3ff5ece90",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6054d7b182669d0ab565897d18912c9fe97d22bf",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd\ufffdC\ufffdc",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdC\ufffdc",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
�h(�
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "deab96328757c57430c3da1064ee2174",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"request_sample": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b68b7b0b4fcdefd18a1de6a9fca01ccf71fe94d",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffdh(\ufffd",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdh(\ufffd",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
��C�c
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df8005337761b32b101374e3ff5ece90",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 34
},
"payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6054d7b182669d0ab565897d18912c9fe97d22bf",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffd\ufffdC\ufffdc",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdC\ufffdc",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 10,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_2a4cd6d346d0a9fc HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_2a4cd6d346d0a9fc HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_2a4cd6d346d0a9fc HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.503170637388557,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c5dbc839adadaf22c15c02389b4e43d8",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "326e5f93c1ec7b0bcb830fbf3ecf08c69589e53b",
"protocol_details": {
"payload_preview": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_2a4cd6d346d0a9fc HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_9a20d32ea14b4b0a HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_9a20d32ea14b4b0a HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_9a20d32ea14b4b0a HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.499788019018764,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4152465c3c68f5dac4a8d1890730b374",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc3854135e5d99e9d7e035cc007f0fa3ad9f13e1",
"protocol_details": {
"payload_preview": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_9a20d32ea14b4b0a HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_5ee44f5bbb0e8927 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_5ee44f5bbb0e8927 HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_5ee44f5bbb0e8927 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.510362760767672,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ed629672d1b1f202ae85fb0057074c8",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ca1a7d467b483c425dd33452598d85d1b3b7a41",
"protocol_details": {
"payload_preview": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_5ee44f5bbb0e8927 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_56dc5372489d87b9 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_56dc5372489d87b9 HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_56dc5372489d87b9 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.532791466518089,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2eb359b088eebf247fa336c276a74344",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "67ab08cb734941a52e5b98bc473bc7e27f5cfd32",
"protocol_details": {
"payload_preview": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_56dc5372489d87b9 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_a78748687f8ac28d HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_a78748687f8ac28d HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_a78748687f8ac28d HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.518565214248213,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2fc8f7bee5d729b9f5b72438f9e53353",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "89aed09a619624d4e02d46cd03db63abed5e4d0a",
"protocol_details": {
"payload_preview": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_a78748687f8ac28d HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_287254a89cd76f00 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_287254a89cd76f00 HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_287254a89cd76f00 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.52434605262823,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "341e98c8af31f7563e9d5acb9cc921f2",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba87bf85d27a604ab4fa3e51f1e39e02983990fb",
"protocol_details": {
"payload_preview": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_287254a89cd76f00 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_2c764455b0db406f HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_2c764455b0db406f HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_2c764455b0db406f HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.518143795014119,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d281a9df48819d5a5c80afcdc45c6836",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9fab4b050e7e71435bbb132e00807d3a503432b8",
"protocol_details": {
"payload_preview": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_2c764455b0db406f HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_48e432288a547fb0 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_48e432288a547fb0 HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_48e432288a547fb0 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.522689084622129,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7fae6f87ad83fb9f32f91d0dbf8b1b3d",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1458777aba28ff61e29d269a7bddda4c53d6df20",
"protocol_details": {
"payload_preview": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_48e432288a547fb0 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_e4fa22ef427479fb HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_e4fa22ef427479fb HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_e4fa22ef427479fb HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.516749839366114,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "353b586ec9c317ab1aa9af2ca5184b3d",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e462beff977b2451cf03c9579afcf25753714236",
"protocol_details": {
"payload_preview": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_e4fa22ef427479fb HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
Cross-site scripting
xss attack · via SOCKS5:1080 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
GET /check_9ce2291648e0c7c5 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /check_9ce2291648e0c7c5 HTTP/1.1
Host: we-love-the.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /check_9ce2291648e0c7c5 HTTP/1.1 Host: we-love-the.world User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 409,
"payload_entropy": 5.504384048220515,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4a526de3e3e80b022b7aab8d66c3b7c1",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"request_sample": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"request_sample": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
"payload_snippet": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f29a09ca53ca1e4e4c215f7a90e418e57d1be7b",
"protocol_details": {
"payload_preview": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (93.123.118.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/check_9ce2291648e0c7c5 HTTP\/1.1\r\nHost: we-love-the.world\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_socks5_probe",
"socks5_emulated"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
P�C�c
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 9,
"payload_entropy": 2.94770277922009,
"port_category": "registered",
"org": "LLC Vash Kredit Bank",
"service": "socks5",
"app_proto": "socks5",
"asn": 209630,
"country": "BG",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BG",
"asn": 209630,
"org": "LLC Vash Kredit Bank",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "656f2ade018285154084843e184aaa89",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"request_sample": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"payload_snippet": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"payload_snippet": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "560627375792857d4bce200e9a4fb4fbc34a8b81",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "P\ufffdC\ufffdc",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "P\ufffdC\ufffdc",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (93.123.118.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "93.123.118.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
|