Renseignement sur les menaces

Bulgarie

93.152.208.38

FAI Alferov Aleksey Aleksandrovich Première vue 13/05/2026 08:59 UTC Dernière vue 21/07/2026 17:23 UTC Risque Critique

Période analysée : 2026-06-21 → 2026-07-21

Activité suspecte — risque 43/100 (Moyen) — MITRE TA0001 — confiance 67 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 13/05/2026 08:59 UTC

Dernière observation 21/07/2026 17:23 UTC

Événements (période) 572

MITRE ATT&CK principal TA0001 475 occurrences

Activité suspecte — risque 43/100 (Moyen) — MITRE TA0001 — confiance 67 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « xss_attack » (signaux protocolaires) · confiance 59%

Confiance 67 % — Score WAF 72 · Bonus corrélation +8 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 211486 · 93.152.208.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 572 événements sur la période pour cette IP.

93.152.208.42 Sonde TLS 21/07/2026 16:30 UTC
93.152.208.26 Sonde TLS 21/07/2026 16:17 UTC
77.91.71.23 Sonde PostgreSQL 21/07/2026 15:52 UTC
77.91.71.91 Sonde PostgreSQL 21/07/2026 15:13 UTC
77.91.71.25 Sonde PostgreSQL 21/07/2026 15:08 UTC
77.91.71.90 Sonde PostgreSQL 21/07/2026 15:07 UTC
77.91.71.92 Sonde PostgreSQL 21/07/2026 14:57 UTC
93.152.208.18 web attack 13/05/2026 11:55 UTC

Événements (filtres)

572

Première observation

13/05/2026 08:59 UTC

Dernière observation

21/07/2026 17:23 UTC

Dernière activité (filtres)

21/07/2026 17:23 UTC

Événements 7j

248

Ports distincts (7j)

122

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 272 TLS TCP 260 SAP MS TCP 4 SSH ALT2 TCP 4 HDFS NAMENODE TCP 2 DISCORD WEBHOOK TCP 2 SAP Diag TCP 2 PERSONAL AGENT TCP 2 GE EGD TCP 2 SMTP ALT2 TCP 2 GOPHER TCP 2 POP3S TCP 2 GRAPHQL API TCP 2 STRATUM TCP 2 DIAMETER TCP 2 ROCKETMQ TCP 2 MINIKUBE NODEPORT TCP 1 WEBLOGIC CLUSTER TCP 1 ELASTICSEARCH NODE TCP 1 HTTP ALT 8040 TCP 1

HTTP

272

TLS

260

SAP MS

SSH ALT2

HDFS NAMENODE

DISCORD WEBHOOK

Géolocalisation

Origine réseau déclarée

Bulgarie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Alferov Aleksey Aleksandrovich 754 Port 5680 tls_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

xss attack · via HTTP:5680 · (tentative d'exploit)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 S…

Aperçu payload

GET / HTTP/1.1 Host: 62.3.50.33:5680 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec

Port / service

5680 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0284

Confiance

67% Corrélation +8

Famille de menace

unknown

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

572 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

572 événement(s) — page 6/12

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/07/2026 16:43:43 UTC	TCP	7350 · HTTP	http	Cross-site scripting xss attack · via HTTP:7350 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7350 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7350 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7350 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "61060ed8de77230dc8bbbaba778bc829d5f07eb1", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.443747803419007, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 7350, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d4717d2894c0a24445277cbc813aa044c3c71776", "event_fingerprint": "faf34f8c0b72e419ede2c06c4368d655073da14b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "2e3232ad710b9d405bc66bf0b98d7fe9", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7350, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7527f1339694ebf8d241e4b9b4c311779786e4b9", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7350, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:7350 \u00b7 (tentative d'exploit)", "target_port_label": "7350 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7350, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7350, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7350 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7350\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "7350 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7350" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 16:43:42 UTC	TCP	7350 · TLS	tls	Sonde TLS tls probe · via TLS:7350 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7350 Chemin / cible — Service TLS Payload ��t��M_0�(��T��(9)""� %�� & T��A��PP�!�, �DJ@��/3r��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��t��M_0�(��T��(9)""�%�� & T��A��PP�!�,�DJ@��/3r��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��t��M_0�(��T��(9)""� %�� & T��A��PP�!�, �DJ@��/3r��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.253382517270631, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 7350, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a2517f79edc8bccc35a69880e70b94eee777cd12", "event_fingerprint": "15940bd54907b99890e9d9182ecdf48a0ab6df6d", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "d0789a47403d4509f0f5700a23e61a74", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 7350, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffdM_0\u0014\ufffd(\ufffd\ufffdT\ufffd\ufffd\u0014\u001b(9)\u000f\"\"\ufffd\f%\ufffd\ufffd\ufffd\ufffd & \u0016T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\u000b\ufffdDJ\u0015@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\u0019\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffdM_0\u0014\ufffd(\ufffd\ufffdT\ufffd\ufffd\u0014\u001b(9)\u000f\"\"\ufffd\f%\ufffd\ufffd\ufffd\ufffd & \u0016T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\u000b\ufffdDJ\u0015@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\u0019\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffdM_0\u0014\ufffd(\ufffd\ufffdT\ufffd\ufffd\u0014\u001b(9)\u000f\"\"\ufffd\f%\ufffd\ufffd\ufffd\ufffd & \u0016T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\u000b\ufffdDJ\u0015@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\u0019\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f2dd7eae8a10411dc84079919848460056eef587", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffdM_0\u0014\ufffd(\ufffd\ufffdT\ufffd\ufffd\u0014\u001b(9)\u000f\"\"\ufffd\f%\ufffd\ufffd\ufffd\ufffd & \u0016T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\u000b\ufffdDJ\u0015@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\u0019\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7350, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdt\ufffd\ufffdM_0\ufffd(\ufffd\ufffdT\ufffd\ufffd(9)\"\"\ufffd%\ufffd\ufffd\ufffd\ufffd & T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\ufffdDJ@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:7350 \u00b7 (sonde \/ probe)", "target_port_label": "7350 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7350, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdt\ufffd\ufffdM_0\u0014\ufffd(\ufffd\ufffdT\ufffd\ufffd\u0014\u001b(9)\u000f\"\"\ufffd\f%\ufffd\ufffd\ufffd\ufffd & \u0016T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\u000b\ufffdDJ\u0015@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\u0019\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7350, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:7350 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdt\ufffd\ufffdM_0\ufffd(\ufffd\ufffdT\ufffd\ufffd(9)\"\"\ufffd%\ufffd\ufffd\ufffd\ufffd & T\ufffd\ufffdA\ufffd\ufffd\ufffdPP\ufffd!\ufffd,\ufffdDJ@\ufffd\ufffd\/3r\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "7350 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7350" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 16:30:07 UTC	TCP	10198 · HTTP	http	Cross-site scripting xss attack · via HTTP:10198 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10198 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10198 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10198 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "a4b63c05ce869802e2d3031e05e192588a901a0e", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.453148838500311, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 10198, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dbd262d1441f8bbc504223d0ef8f3ae5019c1c5e", "event_fingerprint": "5d4aa1671e9db751badd9c2f837bcf46899cb648", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "9fd2a572fab36e3463c8f410dabd0f22", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 10198, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b7c9e0137463e29aa72e36ddc4e0e22b7ca6fb08", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 10198, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:10198 \u00b7 (tentative d'exploit)", "target_port_label": "10198 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10198, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 10198, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10198 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10198\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "10198 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10198" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 16:30:06 UTC	TCP	10198 · TLS	tls	Sonde TLS tls probe · via TLS:10198 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10198 Chemin / cible — Service TLS Payload �gKAIF��Ny��&{ ��+�/�\|�? ��m �E��h�N㺵��V��zRH��s�U\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �gKAIF��Ny��&{��+�/�\|�? ��m�E��h�N㺵��V��zRH��s�U\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �gKAIF��Ny��&{ ��+�/�\|�? ��m �E��h�N㺵��V��zRH��s�U\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.334746563432702, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 10198, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "60a78af32947f240d3e50a57ed67a3618188d76f", "event_fingerprint": "dfa7251be84e719292e198345d3798d5bc0d9775", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "c3ba0d8f4c858069f189fa3d884a8fbc", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 10198, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003gKAIF\ufffd\ufffd\u001c\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\u000b\ufffd\ufffd+\ufffd\/\ufffd\|\ufffd?\u0000 \ufffd\ufffdm\u000b\ufffd\bE\ufffd\ufffdh\u000f\ufffdN\u3eb5\ufffd\ufffdV\ufffd\u001f\ufffdzRH\ufffd\ufffds\ufffdU\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003gKAIF\ufffd\ufffd\u001c\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\u000b\ufffd\ufffd+\ufffd\/\ufffd\|\ufffd?\u0000 \ufffd\ufffdm\u000b\ufffd\bE\ufffd\ufffdh\u000f\ufffdN\u3eb5\ufffd\ufffdV\ufffd\u001f\ufffdzRH\ufffd\ufffds\ufffdU\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003gKAIF\ufffd\ufffd\u001c\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\u000b\ufffd\ufffd+\ufffd\/\ufffd\|\ufffd?\u0000 \ufffd\ufffdm\u000b\ufffd\bE\ufffd\ufffdh\u000f\ufffdN\u3eb5\ufffd\ufffdV\ufffd\u001f\ufffdzRH\ufffd\ufffds\ufffdU\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7bbc9b8beec25533a08cd571a193f596b9af4d5e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003gKAIF\ufffd\ufffd\u001c\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\u000b\ufffd\ufffd+\ufffd\/\ufffd\|\ufffd?\u0000 \ufffd\ufffdm\u000b\ufffd\bE\ufffd\ufffdh\u000f\ufffdN\u3eb5\ufffd\ufffdV\ufffd\u001f\ufffdzRH\ufffd\ufffds\ufffdU\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 10198, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdgKAIF\ufffd\ufffd\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\ufffd\ufffd+\ufffd\/\ufffd\|\ufffd? \ufffd\ufffdm\ufffdE\ufffd\ufffdh\ufffdN\u3eb5\ufffd\ufffdV\ufffd\ufffdzRH\ufffd\ufffds\ufffdU\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:10198 \u00b7 (sonde \/ probe)", "target_port_label": "10198 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 10198, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003gKAIF\ufffd\ufffd\u001c\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\u000b\ufffd\ufffd+\ufffd\/\ufffd\|\ufffd?\u0000 \ufffd\ufffdm\u000b\ufffd\bE\ufffd\ufffdh\u000f\ufffdN\u3eb5\ufffd\ufffdV\ufffd\u001f\ufffdzRH\ufffd\ufffds\ufffdU\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 10198, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:10198 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdgKAIF\ufffd\ufffd\ufffd\ufffd\ufffdNy\ufffd\ufffd\ufffd\ufffd\ufffd&{\ufffd\ufffd+*\ufffd\/\ufffd\|\ufffd? \ufffd\ufffdm\ufffdE\ufffd\ufffdh\ufffdN\u3eb5\ufffd\ufffdV\ufffd\ufffdzRH\ufffd\ufffds\ufffdU\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "10198 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "10198" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 14:25:23 UTC	TCP	8586 · TLS	tls	Sonde TLS tls probe · via TLS:8586 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8586 Chemin / cible — Service TLS Payload �2��_��![Jx��zP3�� /myv��Y ��ZV��B�� {bbhN�'Itu(&�\�E�HX\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �2��_��![Jx��zP3�� /myv��Y ��ZV��B�� {bbhN�'Itu(&�\�E�HX\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �2��_��![Jx��zP3�� /myv��Y ��ZV��B�� {bbhN�'Itu(&�\�E�HX\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.317175032340007, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 8586, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "05170b8eb013b4f8f7e6ae60a43030ce9ec1bd09", "event_fingerprint": "45df7f27e3a3229e89a3e6a78d1c4a66e214b89b", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "443b9ff56c98f550b00d961f3916c611", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8586, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\u001f\ufffdz\u0015P3\ufffd\ufffd\n\ufffd\/my\u0015v\ufffd\ufffdY \ufffd\ufffd\ufffdZV\ufffd\ufffdB\u0000\ufffd\ufffd\u001a\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\u001f\ufffdz\u0015P3\ufffd\ufffd\n\ufffd\/my\u0015v\ufffd\ufffdY \ufffd\ufffd\ufffdZV\ufffd\ufffdB\u0000\ufffd\ufffd\u001a\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\u001f\ufffdz\u0015P3\ufffd\ufffd\n\ufffd\/my\u0015v\ufffd\ufffdY \ufffd\ufffd\ufffdZV\ufffd\ufffdB\u0000\ufffd\ufffd\u001a\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1c4ea64d3ac6347db81c1f3757de394b20aaa38a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\u001f\ufffdz\u0015P3\ufffd\ufffd\n\ufffd\/my\u0015v\ufffd\ufffdY \ufffd\ufffd\ufffdZV\ufffd\ufffdB\u0000\ufffd\ufffd\u001a\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8586, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd2\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\ufffdzP3\ufffd\ufffd\n\ufffd\/myv\ufffd\ufffdY \ufffd\ufffd\ufffdZV\ufffd\ufffdB\ufffd\ufffd\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:8586 \u00b7 (sonde \/ probe)", "target_port_label": "8586 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8586, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\u001f\ufffdz\u0015P3\ufffd\ufffd\n\ufffd\/my\u0015v\ufffd\ufffdY \ufffd\ufffd\ufffdZV\ufffd\ufffdB\u0000\ufffd\ufffd\u001a\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8586, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8586 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd2\ufffd\ufffd_\ufffd\ufffd\ufffd![Jx\ufffd\ufffdzP3\ufffd\ufffd\n\ufffd\/myv\ufffd\ufffd*Y \ufffd\ufffd\ufffdZV\ufffd\ufffdB\ufffd\ufffd\t{bbhN\ufffd'Itu(&\ufffd\\\ufffdE\ufffdHX\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8586 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8586" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 14:25:23 UTC	TCP	8586 · HTTP	http	Cross-site scripting xss attack · via HTTP:8586 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8586 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8586 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8586 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "1d3545c0d82d65f1657ed637ecdfed2d0794dcd7", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.454288108697064, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 8586, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6b43a62fe2066c746fbcbb0b2082353a01a2c564", "event_fingerprint": "3361804960cf68b52cd93b1618d0cbd7007df6c8", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "bb9eeabc5cd830236375a6415657c57a", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8586, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "624304d8f869820ed5f57416d673ea176ec34f6c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8586, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8586 \u00b7 (tentative d'exploit)", "target_port_label": "8586 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8586, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8586, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8586 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8586\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8586 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8586" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 14:21:48 UTC	TCP	26441 · TLS	tls	Sonde TLS tls probe · via TLS:26441 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26441 Chemin / cible — Service TLS Payload �oX�B�Q��^�ګ?��]��8vV��i� ��\�"��,:ш�+�J95rA��@'��ǟ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �oX�B�Q��^�ګ?��]��8vV��i� ��\�"��,:ш�+�J95rA��@'��ǟ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �oX�B�Q��^�ګ?��]��8vV��i� ��\�"��,:ш�+�J95rA��@'��ǟ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.29441520952881, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 26441, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "227697cc7418178cdc21473b0be35108039e2365", "event_fingerprint": "1e56e51a68a63ae5a93ac0e5ef606b003fdfeadc", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "5713bf8d8ff793b927f80e373eb451d2", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 26441, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001eoX\ufffdB\ufffdQ\ufffd\u0018\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\u0007\ufffd\ufffd\u00068vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\u0017\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001eoX\ufffdB\ufffdQ\ufffd\u0018\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\u0007\ufffd\ufffd\u00068vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\u0017\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001eoX\ufffdB\ufffdQ\ufffd\u0018\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\u0007\ufffd\ufffd\u00068vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\u0017\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "116c7e80c5171c6249ae9518be07d50d74bf7dd0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001eoX\ufffdB\ufffdQ\ufffd\u0018\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\u0007\ufffd\ufffd\u00068vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\u0017\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 26441, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdoX\ufffdB\ufffdQ\ufffd\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\ufffd\ufffd8vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:26441 \u00b7 (sonde \/ probe)", "target_port_label": "26441 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 26441, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001eoX\ufffdB\ufffdQ\ufffd\u0018\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\u0007\ufffd\ufffd\u00068vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\u0017\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 26441, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:26441 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdoX\ufffdB\ufffdQ\ufffd\ufffd^\ufffd\u06ab?\ufffd\ufffd]\ufffd\ufffd\ufffd8vV\ufffd\ufffdi\ufffd \ufffd\ufffd\\\ufffd\"\ufffd\ufffd\ufffd,:\u0448\ufffd+\ufffdJ95rA\ufffd\ufffd\ufffd\ufffd\ufffd@'\ufffd\ufffd\u01df\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "26441 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "26441" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 14:21:48 UTC	TCP	26441 · HTTP	http	Cross-site scripting xss attack · via HTTP:26441 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 26441 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:26441 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:26441 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "f6b35d45f8dfc6c055bb31b1b7b80287f7c70956", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.455614590642987, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 26441, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 47, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7d843624b21bcd5e91096be4b0e43a0076f14554", "event_fingerprint": "3fc63ce142d82c643f05829fa4595306b378f2a8", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "cada63de6d506f24867af4c9d37f12d0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 26441, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f37b8cf1ffa8c0a573f7867f017a47bb9b194e1f", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 26441, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:26441 \u00b7 (tentative d'exploit)", "target_port_label": "26441 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 26441, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 26441, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:26441 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:26441\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "26441 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "26441" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 14:15:09 UTC	TCP	8881 · TLS	tls	Sonde TLS tls probe · via TLS:8881 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8881 Chemin / cible — Service TLS Payload �!n�n��̉ͭ��&= �⃉A��)� fz-�� SQ>5S�׈;͢��`��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �!n�n��̉ͭ��&=�⃉A��)� fz-�� SQ>5S�׈;͢��`��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �!n�n��̉ͭ��&= �⃉A��)� fz-�� SQ>5S�׈;͢��`��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.249608858762998, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 8881, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "223d48f493fa6622851e82bc9b7ed22d51c414f1", "event_fingerprint": "d8af245a4dd4da06a8d1972d2d4e8c981eef21bb", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "3740aaf9c399cff26f182034b4609043", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8881, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\u000b\ufffd\u20c9A\ufffd\ufffd\u0000\ufffd\u0015\ufffd\ufffd)\ufffd\b fz-\ufffd\ufffd\n\ufffd\ufffd\u000eSQ>5S\ufffd\u0013\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\u0005\ufffd\u0003\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\u000b\ufffd\u20c9A\ufffd\ufffd\u0000\ufffd\u0015\ufffd\ufffd)\ufffd\b fz-\ufffd\ufffd\n\ufffd\ufffd\u000eSQ>5S\ufffd\u0013\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\u0005\ufffd\u0003\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\u000b\ufffd\u20c9A\ufffd\ufffd\u0000\ufffd\u0015\ufffd\ufffd)\ufffd\b fz-\ufffd\ufffd\n\ufffd\ufffd\u000eSQ>5S\ufffd\u0013\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\u0005\ufffd\u0003\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ba029f89fd6b3453c027c145a11325a12c83f7a9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\u000b\ufffd\u20c9A\ufffd\ufffd\u0000\ufffd\u0015\ufffd\ufffd)\ufffd\b fz-\ufffd\ufffd\n\ufffd\ufffd\u000eSQ>5S\ufffd\u0013\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\u0005\ufffd\u0003\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8881, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\ufffd\u20c9A\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd fz-\ufffd\ufffd\n\ufffd\ufffdSQ>5S\ufffd\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:8881 \u00b7 (sonde \/ probe)", "target_port_label": "8881 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8881, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\u000b\ufffd\u20c9A\ufffd\ufffd\u0000\ufffd\u0015\ufffd\ufffd)\ufffd\b fz-\ufffd\ufffd\n\ufffd\ufffd\u000eSQ>5S\ufffd\u0013\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\u0005\ufffd\u0003\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8881, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8881 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd!n\ufffdn\ufffd\ufffd\ufffd\u0309\u036d\ufffd\ufffd&=\ufffd\u20c9A\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd fz-\ufffd\ufffd\n\ufffd\ufffdSQ>5S\ufffd\u05c8;\u0362\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8881 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8881" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 14:15:09 UTC	TCP	8881 · HTTP	http	Cross-site scripting xss attack · via HTTP:8881 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8881 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8881 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8881 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "f0c5dd0b6f8c13b159c89d4f3500b24a21a6195d", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455929767925268, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 8881, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6efd77bdf55079384cd10193b91d036de16cb0bb", "event_fingerprint": "534ee7ea79927c745ccf391308c28faef5f9271e", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "d019c9483b2b0858a13c44d74a7ca1e6", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8881, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9a34aa1901689af38eceba4d72e83842469486c9", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8881, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8881 \u00b7 (tentative d'exploit)", "target_port_label": "8881 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8881, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8881, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8881 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8881\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8881 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8881" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 14:10:31 UTC	TCP	1947 · TLS	tls	Sonde TLS tls probe · via TLS:1947 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1947 Chemin / cible — Service TLS Payload �D�>Y^��`x��-�$�!pV��\|�� cQן y�?�WHM��o��Te��-;\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �D�>Y^��`x��-�$�!pV��\|�� cQן y�?�WHM��o��Te��-;\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �D�>Y^��`x��-�$�!pV��\|�� cQן y�?�WHM��o��Te��-;\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.315154876460779, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 1947, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cdf0e8c9d879014b04ac28c10c33d983cceafa62", "event_fingerprint": "2296c1b9bbc22f1c20bce00aeb860a0c1f8981bf", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "afda675e81d94f766a0b35849c1fb296", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 1947, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\ufffd>Y^\ufffd\u000f\ufffd\u001d`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\u0006\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffd\u001ao\ufffd\u0003\ufffd\u0005\ufffd\ufffdT\u001be\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\ufffd>Y^\ufffd\u000f\ufffd\u001d`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\u0006\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffd\u001ao\ufffd\u0003\ufffd\u0005\ufffd\ufffdT\u001be\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\ufffd>Y^\ufffd\u000f\ufffd\u001d`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\u0006\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffd\u001ao\ufffd\u0003\ufffd\u0005\ufffd\ufffdT\u001be\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94db6ebbd35c140d75b44b65cb704d7e633de4a9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\ufffd>Y^\ufffd\u000f\ufffd\u001d`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\u0006\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffd\u001ao\ufffd\u0003\ufffd\u0005\ufffd\ufffdT\u001be\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1947, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdD\ufffd>Y^\ufffd\ufffd`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffdTe\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:1947 \u00b7 (sonde \/ probe)", "target_port_label": "1947 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1947, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003D\ufffd>Y^\ufffd\u000f\ufffd\u001d`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\u0006\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffd\u001ao\ufffd\u0003\ufffd\u0005\ufffd\ufffdT\u001be\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1947, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:1947 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdD\ufffd>Y^\ufffd\ufffd`x\ufffd\ufffd\ufffd-\ufffd$\ufffd!pV\ufffd\ufffd\|\ufffd\ufffd\n\ufffdcQ\u05df y\ufffd?\ufffdWHM\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffdTe\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd-;\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "1947 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1947" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 14:10:31 UTC	TCP	1947 · HTTP	http	Cross-site scripting xss attack · via HTTP:1947 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1947 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1947 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1947 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "5564ad7b41a30d8489b29c129af7dfbfee3bb4ca", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.452809185223923, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 1947, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f9b3131ed3c272079d58f21771442588d3b25573", "event_fingerprint": "d8383f251be67592b5b221d728c97a95885e2dbf", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "d804b2b7792822b6bd3e97976043c69c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1947, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c50e2ba413d403f773521e5e5dab5f0dddc00549", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1947, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:1947 \u00b7 (tentative d'exploit)", "target_port_label": "1947 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1947, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1947, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:1947 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1947\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "1947 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1947" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 12:57:31 UTC	TCP	9370 · TLS	tls	Sonde TLS tls probe · via TLS:9370 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9370 Chemin / cible — Service TLS Payload ��\-�\��vݣ!�HtO.V\|G�n5��` �bo'f1�#/~�s�ŋ ��՗�� \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��\-�\��vݣ!�HtO.V\|G�n5��` �bo'f1�#/~�s�ŋ ��՗�� \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��\-�\��vݣ!�HtO.V\|G�n5��` �bo'f1�#/~�s�ŋ ��՗�� \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.295614606295184, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 9370, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "2dbd0f9fd1b216b63bb632b47a81e8cf09faba99", "event_fingerprint": "e44e60ba9f37b91cc119d498c93f85f059b851f7", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "d5c2650e4c64de4625754e04c0c1735e", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 9370, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\\u0017\u001c-\u000e\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO\u0016\u001e.V\|\u0010G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\u001a\/~\u000e\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\u0004\ufffd\n\ufffd\u0011\u0014\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\\u0017\u001c-\u000e\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO\u0016\u001e.V\|\u0010G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\u001a\/~\u000e\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\u0004\ufffd\n\ufffd\u0011\u0014\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\\u0017\u001c-\u000e\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO\u0016\u001e.V\|\u0010G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\u001a\/~\u000e\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\u0004\ufffd\n\ufffd\u0011\u0014\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "272f6bb68710a540b6b99065028cdc43269b7bf2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\\u0017\u001c-\u000e\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO\u0016\u001e.V\|\u0010G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\u001a\/~\u000e\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\u0004\ufffd\n\ufffd\u0011\u0014\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9370, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\\-\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO.V\|G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\/~\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:9370 \u00b7 (sonde \/ probe)", "target_port_label": "9370 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9370, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\\\u0017\u001c-\u000e\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO\u0016\u001e.V\|\u0010G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\u001a\/~\u000e\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\u0004\ufffd\n\ufffd\u0011\u0014\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9370, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:9370 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\\-\ufffd\\\ufffd\ufffd\ufffdv\u0763!\ufffdHtO.V\|G\ufffdn5\ufffd\ufffd` \ufffdbo'f1\ufffd#\/~\ufffds\ufffd\u014b\n\ufffd\ufffd\u0557\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9370 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9370" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 12:57:31 UTC	TCP	9370 · HTTP	http	Cross-site scripting xss attack · via HTTP:9370 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9370 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9370 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9370 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "8cbbb77dd671a7e3bf456e034d3c31804a1673f0", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.445890041444755, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 9370, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1a627189575885f7d1220e4b073a4aabb741f24e", "event_fingerprint": "64f29a9f800e32332e3beb2ab93b814b51bf63f2", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "6d4ad481d022e3a4b32be1b740be7d56", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9370, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eb1be3272bff3c5f1f5520520171a32215e268c3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9370, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:9370 \u00b7 (tentative d'exploit)", "target_port_label": "9370 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9370, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9370, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:9370 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9370\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9370 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9370" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 12:32:17 UTC	TCP	8919 · TLS	tls	Sonde TLS tls probe · via TLS:8919 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8919 Chemin / cible — Service TLS Payload �i07�g�W:ʹ����=#6 �U\|��)�M{ (:��t�wV7KsiT\|���ۅaɺ^\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �i07�g�W:ʹ����=#6 �U\|��)�M{ (:��t�wV7KsiT\|���ۅaɺ^\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �i07�g�W:ʹ����=#6 �U\|��)�M{ (:��t�wV7KsiT\|���ۅaɺ^\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.2562295506450925, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 8919, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6e918b1bc9246bd46c32754cb61c2972d0e25d34", "event_fingerprint": "bee6e66577be8e4c0a39cfaf5196e13a3280bf08", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "6675c1f9d23f7e7c3a1cbff47d83c947", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8919, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c112aea64eaefa3d39e00a308d2c45a862c3eb8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8919, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdi07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ (:\ufffd\ufffd\ufffdt\ufffdwV7KsiT\|\ufffd\ufffd\ufffd\u06c5a\u027a^\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:8919 \u00b7 (sonde \/ probe)", "target_port_label": "8919 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8919, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003i07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \f\ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ \u0011(:\ufffd\ufffd\ufffd\u0019t\ufffdwV7KsiT\u001d\|\ufffd\u0003\u0019\ufffd\ufffd\u06c5a\u027a^\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8919, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8919 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdi07\ufffdg\ufffdW:\u0374\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=#6 \ufffdU\|\ufffd\ufffd\ufffd)\ufffdM{ (:\ufffd\ufffd\ufffdt\ufffdwV7KsiT\|\ufffd*\ufffd\ufffd\u06c5a\u027a^\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8919 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8919" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 12:32:17 UTC	TCP	8919 · HTTP	http	Cross-site scripting xss attack · via HTTP:8919 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8919 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8919 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8919 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "f71905df9044fbcd79eb6dd879c2477e9df4f29f", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455929767925268, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 8919, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f2f3bd17dc8fc014c922f58a9d77519d8f40ab14", "event_fingerprint": "c8332463b4d99cf937823c3b9abfd1991c9fa1fe", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "b1314af8aaeba0cd4e1457451269b06f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8919, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f13b2787c3879e99749368fa29f498be86586b0d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8919, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8919 \u00b7 (tentative d'exploit)", "target_port_label": "8919 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8919, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8919, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8919 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8919\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8919 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8919" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 12:11:13 UTC	TCP	8890 · TLS	tls	Sonde TLS tls probe · via TLS:8890 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8890 Chemin / cible — Service TLS Payload ��zj��(�&�s�q��(�ǶMd�� ި��m�[?��Y��t��=�O.��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��zj��(�&�s�q��(�ǶMd�� ި��m�[?��Y��t��=�O.��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��zj��(�&�s�q��(�ǶMd�� ި��m�[?��Y��t��=�O.��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.283321713409835, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 8890, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b781610940cb377ecf2e5d0645c0c1a3d6dba817", "event_fingerprint": "127395cd5217669e0d6a9ba4800e7aad2eec2015", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "951bf0dc070ac7b8e0d1635cd581c584", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8890, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdz\u0013j\ufffd\ufffd\u0002\ufffd(\ufffd&\ufffds\u0011\ufffdq\ufffd\u0005\ufffd\ufffd\ufffd\u0012(\ufffd\u0010\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\u0004\ufffd\ufffd\u0013\ufffdm\ufffd[?\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdz\u0013j\ufffd\ufffd\u0002\ufffd(\ufffd&\ufffds\u0011\ufffdq\ufffd\u0005\ufffd\ufffd\ufffd\u0012(\ufffd\u0010\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\u0004\ufffd\ufffd\u0013\ufffdm\ufffd[?\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdz\u0013j\ufffd\ufffd\u0002\ufffd(\ufffd&\ufffds\u0011\ufffdq\ufffd\u0005\ufffd\ufffd\ufffd\u0012(\ufffd\u0010\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\u0004\ufffd\ufffd\u0013\ufffdm\ufffd[?\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9086d5611981cd75c7882c00e518703a36ce11cf", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdz\u0013j\ufffd\ufffd\u0002\ufffd(\ufffd&\ufffds\u0011\ufffdq\ufffd\u0005\ufffd\ufffd\ufffd\u0012(\ufffd\u0010\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\u0004\ufffd\ufffd\u0013\ufffdm\ufffd[?\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8890, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdzj\ufffd\ufffd\ufffd(\ufffd&\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd(\ufffd\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\ufffd\ufffd\ufffdm\ufffd[?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:8890 \u00b7 (sonde \/ probe)", "target_port_label": "8890 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8890, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdz\u0013j\ufffd\ufffd\u0002\ufffd(\ufffd&\ufffds\u0011\ufffdq\ufffd\u0005\ufffd\ufffd\ufffd\u0012(\ufffd\u0010\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\u0004\ufffd\ufffd\u0013\ufffdm\ufffd[?\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 8890, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8890 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdzj\ufffd\ufffd\ufffd(\ufffd&\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd(\ufffd\u01f6Md\ufffd\ufffd\ufffd \ufffd\u07a8\ufffd\ufffd\ufffdm\ufffd[?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdt\ufffd\ufffd=\ufffdO.\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8890 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8890" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 12:11:13 UTC	TCP	8890 · HTTP	http	Cross-site scripting xss attack · via HTTP:8890 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8890 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8890 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8890 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "968b8d81a31fad47e70e10a8c0f91c1f15e8cc9b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.45345783595266, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 8890, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a2c1d7b26f4a8475fa556dfd5ee58a4bf6781e60", "event_fingerprint": "96078881c97bf4936f87f82d41d03b0b10d211b4", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "27db5c84ca871a09b1aa3425e8972cd4", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8890, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "41b95bb9613928d564e128cb3424526e849935ed", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8890, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8890 \u00b7 (tentative d'exploit)", "target_port_label": "8890 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8890, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8890, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8890 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8890\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8890 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8890" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 10:13:51 UTC	TCP	2050 · TLS	tls	Sonde TLS tls probe · via TLS:2050 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2050 Chemin / cible — Service TLS Payload ��AmBo�=�R}c(��ay�2)��N4'[� �[�H��y��7��O: �X��A\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��AmBo�=�R}c(��ay�2)��N4'[� �[�H��y��7��O: �X��A\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��AmBo�=�R}c(��ay�2)��N4'[� �[�H��y��7��O: �X��A\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.310734083598562, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 2050, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "365b4cca1e834d8c61b45dd23851fa21aaa2f084", "event_fingerprint": "88a4752515b9dd14d345be1671fa45bed28124df", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "07886529cb02f447dbb55550fc2f77e8", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 2050, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\u0014\ufffd\ufffd\ufffd\ufffdN4'\u0004[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\u0007\ufffd\ufffd\ufffd\u0001O\u001d:\u001f\u000e\n\ufffdX\ufffd\ufffdA\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\u0014\ufffd\ufffd\ufffd\ufffdN4'\u0004[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\u0007\ufffd\ufffd\ufffd\u0001O\u001d:\u001f\u000e\n\ufffdX\ufffd\ufffdA\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\u0014\ufffd\ufffd\ufffd\ufffdN4'\u0004[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\u0007\ufffd\ufffd\ufffd\u0001O\u001d:\u001f\u000e\n\ufffdX\ufffd\ufffdA\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b1cfac881667d81b58de42814e7d4cc57685ac14", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\u0014\ufffd\ufffd\ufffd\ufffdN4'\u0004[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\u0007\ufffd\ufffd\ufffd\u0001O\u001d:\u001f\u000e\n\ufffdX\ufffd\ufffdA\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 2050, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\ufffd\ufffd\ufffd\ufffdN4'[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffdO:\n\ufffdX\ufffd\ufffdA\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:2050 \u00b7 (sonde \/ probe)", "target_port_label": "2050 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2050, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\u0014\ufffd\ufffd\ufffd\ufffdN4'\u0004[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\u0007\ufffd\ufffd\ufffd\u0001O\u001d:\u001f\u000e\n\ufffdX\ufffd\ufffdA\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 2050, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2050 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdAmBo\ufffd=\ufffdR}c(\ufffd\ufffday\ufffd2)\ufffd\ufffd\ufffd\ufffd\ufffdN4'[\ufffd \ufffd[\ufffdH\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffdO:\n\ufffdX\ufffd\ufffdA\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "2050 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 10:13:51 UTC	TCP	2050 · HTTP	http	Cross-site scripting xss attack · via HTTP:2050 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2050 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2050 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "066f1e97b85f6cb6b3453a0482fbff918ce34177", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.445194382210599, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 2050, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fa9e632fe1443c20c3796c17be24f98b3dbc3156", "event_fingerprint": "687e9d5a286bc8c190d0f6264460a2eaa2f24514", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "9faada3075229cd7c63a1c6f3bd96df3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2050, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a8a115a6d5a05308d2b193496cc0b9b0afcff671", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 2050, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:2050 \u00b7 (tentative d'exploit)", "target_port_label": "2050 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2050, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 2050, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:2050 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2050\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "2050 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 09:47:06 UTC	TCP	1925 · TLS	tls	Sonde TLS tls probe · via TLS:1925 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1925 Chemin / cible — Service TLS Payload ��T��P��}"V+ż(r�%��5��z6�� c@�u�Ĥ��e94˚��)��uX`�14�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��T��P��}"V+ż(r�%��5��z6�� c@�u�Ĥ��e94˚��)��uX`�14�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��T��P��}"V+ż(r�%��5��z6�� c@�u�Ĥ��e94˚��)��uX`�14�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.350671460157292, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 1925, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6d930bdfa33c77f66cec08e3f06bdd464c2d09cf", "event_fingerprint": "8eee80c66324017f3ebcdbe2179d9e42af59c853", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "e6702ba0fe2edd55574bf6b922f7d729", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 1925, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffd\ufffd\u001fP\ufffd\ufffd}\u0007\"V+\u017c(r\ufffd\u001d%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffd\bu\ufffd\u0124\u001a\ufffd\ufffd\ufffde94\u02da\ufffd\u001b\ufffd\ufffd)\u001a\ufffd\ufffduX`\ufffd14\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffd\ufffd\u001fP\ufffd\ufffd}\u0007\"V+\u017c(r\ufffd\u001d%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffd\bu\ufffd\u0124\u001a\ufffd\ufffd\ufffde94\u02da\ufffd\u001b\ufffd\ufffd)\u001a\ufffd\ufffduX`\ufffd14\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffd\ufffd\u001fP\ufffd\ufffd}\u0007\"V+\u017c(r\ufffd\u001d%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffd\bu\ufffd\u0124\u001a\ufffd\ufffd\ufffde94\u02da\ufffd\u001b\ufffd\ufffd)\u001a\ufffd\ufffduX`\ufffd14\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ccc0bf6580a0de6d04c33f9e845e780f4ad661a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffd\ufffd\u001fP\ufffd\ufffd}\u0007\"V+\u017c(r\ufffd\u001d%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffd\bu\ufffd\u0124\u001a\ufffd\ufffd\ufffde94\u02da\ufffd\u001b\ufffd\ufffd)\u001a\ufffd\ufffduX`\ufffd14\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1925, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd}\"V+\u017c(r\ufffd%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffdu\ufffd\u0124\ufffd\ufffd\ufffde94\u02da\ufffd\ufffd\ufffd)\ufffd\ufffduX`\ufffd14\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:1925 \u00b7 (sonde \/ probe)", "target_port_label": "1925 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1925, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffd\ufffd\u001fP\ufffd\ufffd}\u0007\"V+\u017c(r\ufffd\u001d%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffd\bu\ufffd\u0124\u001a\ufffd\ufffd\ufffde94\u02da\ufffd\u001b\ufffd\ufffd)\u001a\ufffd\ufffduX`\ufffd14\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1925, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:1925 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd}\"V+\u017c(r\ufffd%\ufffd\ufffd5\ufffd\ufffdz6\ufffd\ufffd c@\ufffdu\ufffd\u0124\ufffd\ufffd\ufffde94\u02da\ufffd\ufffd\ufffd)\ufffd\ufffduX`\ufffd14\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "1925 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1925" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 09:47:06 UTC	TCP	1925 · HTTP	http	Cross-site scripting xss attack · via HTTP:1925 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1925 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1925 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1925 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "e9009f46cf35190afe5185c98741fa718ba16210", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455016163973888, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 1925, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fec18e8348087cb51957774a48c19888e578c5a3", "event_fingerprint": "f9bdb96214b71eb320a2ec08fb2aa6ada568fbda", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "6f269a1536f15451e7080ee193336956", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1925, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a9b308f83b2e0d590fba20ad8e7ddbd5d2a314c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1925, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:1925 \u00b7 (tentative d'exploit)", "target_port_label": "1925 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1925, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1925, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:1925 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1925\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "1925 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1925" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 08:40:54 UTC	TCP	9394 · TLS	tls	Sonde TLS tls probe · via TLS:9394 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9394 Chemin / cible — Service TLS Payload �6��1'9{�m��ӥ��6�5A��U��@�ݾ �5��I�># �#�adC��f��Ϳ��5�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �6��1'9{�m��ӥ��6�5A��U��@�ݾ �5��I�># �#�adC��f��Ϳ��5�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �6��1'9{�m��ӥ��6�5A��U��@�ݾ �5��I�># �#�adC��f��Ϳ��5�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.307138736153598, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 9394, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "93d6b309a484320f7213b083cdfb1d810b04f1dd", "event_fingerprint": "0a625157024bc22a23c2b65020df0d77928a7112", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "9bdfb17db0d9ef937c0951a416000c47", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 9394, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\u0012\ufffd\u04e5\ufffd\u000e\ufffd6\ufffd5A\ufffd\ufffd\u001dU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd\u000f#\ufffda\bdC\ufffd\ufffd\ufffdf\ufffd\ufffd\u0019\u037f\u0019\ufffd\ufffd\ufffd5\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\u0012\ufffd\u04e5\ufffd\u000e\ufffd6\ufffd5A\ufffd\ufffd\u001dU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd\u000f#\ufffda\bdC\ufffd\ufffd\ufffdf\ufffd\ufffd\u0019\u037f\u0019\ufffd\ufffd\ufffd5\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\u0012\ufffd\u04e5\ufffd\u000e\ufffd6\ufffd5A\ufffd\ufffd\u001dU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd\u000f#\ufffda\bdC\ufffd\ufffd\ufffdf\ufffd\ufffd\u0019\u037f\u0019\ufffd\ufffd\ufffd5\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b5937c0499ee3c474eebc0a68ec47632ed7a9c99", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\u0012\ufffd\u04e5\ufffd\u000e\ufffd6\ufffd5A\ufffd\ufffd\u001dU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd\u000f#\ufffda\bdC\ufffd\ufffd\ufffdf\ufffd\ufffd\u0019\u037f\u0019\ufffd\ufffd\ufffd5\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9394, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd6\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\ufffd\u04e5\ufffd\ufffd6\ufffd5A\ufffd\ufffdU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd#\ufffdadC\ufffd\ufffd\ufffdf\ufffd\ufffd\u037f\ufffd\ufffd\ufffd5\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:9394 \u00b7 (sonde \/ probe)", "target_port_label": "9394 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9394, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\u0012\ufffd\u04e5\ufffd\u000e\ufffd6\ufffd5A\ufffd\ufffd\u001dU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd\u000f#\ufffda\bdC\ufffd\ufffd\ufffdf\ufffd\ufffd\u0019\u037f\u0019\ufffd\ufffd\ufffd5\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 9394, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:9394 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd6\ufffd\ufffd\ufffd1'9{\ufffdm\ufffd\ufffd\u04e5\ufffd\ufffd6\ufffd5A\ufffd\ufffdU\ufffd\ufffd@\ufffd\u077e \ufffd5\ufffd\ufffdI\ufffd>#\n\ufffd#\ufffdadC\ufffd\ufffd\ufffdf\ufffd\ufffd\u037f\ufffd\ufffd\ufffd5\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "9394 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9394" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 08:40:54 UTC	TCP	9394 · HTTP	http	Cross-site scripting xss attack · via HTTP:9394 · (tentative d'exploit)	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9394 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9394 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9394 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "1ab203c6b91c7115b615faafa4c81e9df65bc05c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.45050421144311, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 9394, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "48f8a53e7cd2761cee62f6da01a9801e4fb00004", "event_fingerprint": "6b0308ab3931a2f63d5250c456669d6acbd61342", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "3c3193d20ec71aadce4f3a3b32178d5f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9394, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "33a1fbcc9459f5c25239ec6e86722e85777a3e24", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9394, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:9394 \u00b7 (tentative d'exploit)", "target_port_label": "9394 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9394, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 9394, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:9394 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9394\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "9394 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9394" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 07:48:43 UTC	TCP	2311 · TLS	tls	Sonde TLS tls probe · via TLS:2311 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2311 Chemin / cible — Service TLS Payload �.��F��r��Ӳ�M�,�콃%��a� 0��sŀ�l<��3]~��k%(�9=h�9�d{�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �.��F��r��Ӳ�M�,�콃%��a� 0��sŀ�l<��3]~��k%(�9=h�9�d{�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �.��F��r��Ӳ�M�,�콃%��a� 0��sŀ�l<��3]~��k%(�9=h�9�d{�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.334316931933242, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 2311, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "92571107cbcbea47f9dc10a31bd58ffaede28949", "event_fingerprint": "ba297d005a4cf8fe3ceaea60e327427f83217ace", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "1a924b0d37ceac0e8d7a2675a63262b7", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 2311, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\u001c\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\u001c\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\u001c\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b17651a1b1e7ff3bfa9befacfbc5cc165e2fcaa", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\u001c\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 2311, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:2311 \u00b7 (sonde \/ probe)", "target_port_label": "2311 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2311, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\u001c\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 2311, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2311 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd.\ufffd\ufffdF\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u04f2\ufffdM\ufffd,\ufffd\ucf43%\ufffd\ufffd\ufffd\ufffda\ufffd 0\ufffd\ufffds\u0140\ufffdl<\ufffd\ufffd\ufffd\ufffd3]~\ufffd\ufffdk%(\ufffd9=h\ufffd9\ufffdd{\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "2311 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2311" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 07:48:43 UTC	TCP	2311 · HTTP	http	Cross-site scripting xss attack · via HTTP:2311 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2311 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2311 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2311 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "f3f6b08c89055263d666873051ce9793a0c48714", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.449840896890504, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 2311, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f33336de5aa04c34164d2cd063f5c79dd6b34cfe", "event_fingerprint": "e6bad5be6915cbc97a5438955b2ba40d04c6eae4", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "48126a3922b8522cc5f2e260ab7b5233", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2311, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a3fbbd3e0cadc44c8ee4c7af9fa569f50633d9a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 2311, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:2311 \u00b7 (tentative d'exploit)", "target_port_label": "2311 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2311, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 2311, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:2311 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2311\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "2311 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2311" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
14/07/2026 07:48:25 UTC	TCP	7701 · TLS	tls	Sonde TLS tls probe · via TLS:7701 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7701 Chemin / cible — Service TLS Payload ��d�<�g��E� ��92�E)dbQI-��C ��yٽ,��4U�G/�L��Y?;��1Q�7�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��d�<�g��E� ��92�E)dbQI-��C ��yٽ,��4U�G/�L��Y?;��1Q�7�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��d�<�g��E� ��92�E)dbQI-��C ��yٽ,��4U�G/�L��Y?;��1Q�7�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.299410561957439, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 7701, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "65e08d6c5b6f7282469773822bbc7d29546c8222", "event_fingerprint": "d89d5e4aed952794431a001bd770e151f39a716d", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "def3a105037719ba8014d98012fa9569", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 7701, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\u000f\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\u0000\ufffd\ufffd\bC \ufffd\ufffdy\u067d,\ufffd\u0019\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\u0014\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\u0000\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\u000f\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\u0000\ufffd\ufffd\bC \ufffd\ufffdy\u067d,\ufffd\u0019\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\u0014\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\u0000\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\u000f\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\u0000\ufffd\ufffd\bC \ufffd\ufffdy\u067d,\ufffd\u0019\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\u0014\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\u0000\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4e8837e464f87ab4df4f05f18d247ac4f81c9a38", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\u000f\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\u0000\ufffd\ufffd\bC \ufffd\ufffdy\u067d,\ufffd\u0019\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\u0014\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\u0000\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7701, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\ufffd\ufffdC \ufffd\ufffdy\u067d,\ufffd\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:7701 \u00b7 (sonde \/ probe)", "target_port_label": "7701 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7701, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\u000f\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\u0000\ufffd\ufffd\bC \ufffd\ufffdy\u067d,\ufffd\u0019\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\u0014\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\u0000\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7701, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:7701 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdd\ufffd<\ufffdg\ufffd\ufffdE\ufffd\n\ufffd\ufffd\ufffd92\ufffdE)dbQI-\ufffd\ufffdC \ufffd\ufffdy\u067d,\ufffd\ufffd\ufffd4U\ufffdG\/\ufffdL\ufffd\ufffd\ufffdY?;\ufffd\ufffd1Q\ufffd7\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "7701 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7701" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 07:48:25 UTC	TCP	7701 · HTTP	http	Cross-site scripting xss attack · via HTTP:7701 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7701 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7701 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7701 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "0e7f41ecd9002bd3fdf24386c543f192c455aa5b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.44605277719982, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 7701, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c78220890bc2f6a52b8e2d039d5e1df18d133f71", "event_fingerprint": "3fadec0d82f0ee8bc292bf1bfca1e72a584b9039", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "6cb57ffc5b599f2a02878cf2073e2224", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7701, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34ada76ce7633aae387330335e69693ab1ede468", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7701, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:7701 \u00b7 (tentative d'exploit)", "target_port_label": "7701 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7701, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7701, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7701 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7701\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "7701 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7701" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 07:23:55 UTC	TCP	5929 · TLS	tls	Sonde TLS tls probe · via TLS:5929 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5929 Chemin / cible — Service TLS Payload �\|�r�P��g�k8�!)Fɹ70�?d�S��5� Q�(}�b N��r�F��rm� Jy$� \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �\|�r�P��g�k8�!)Fɹ70�?d�S��5� Q�(}�b N��r�F��rm� Jy$� \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �\|�r�P��g�k8�!)Fɹ70�?d�S��5� Q�(}�b N��r�F��rm� Jy$� \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.298467891580132, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 5929, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "2d9c84c757413d4de319e27d161e385331ee4c85", "event_fingerprint": "c8b3fb38c32d05d7241d66a9f7b9a39c02bdfafb", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "b13c99fec3ff83ad29b114a8882d6e33", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 5929, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\|\ufffdr\ufffdP\ufffd\ufffdg\ufffd\u001fk8\ufffd!)F\u027970\ufffd?\u001ad\ufffd\u000eS\ufffd\ufffd\u001d5\ufffd Q\ufffd\u0001(}\ufffd\u0003b\nN\ufffd\ufffd\u0006r\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdr\u0014m\ufffd\rJy$\ufffd\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\|\ufffdr\ufffdP\ufffd\ufffdg\ufffd\u001fk8\ufffd!)F\u027970\ufffd?\u001ad\ufffd\u000eS\ufffd\ufffd\u001d5\ufffd Q\ufffd\u0001(}\ufffd\u0003b\nN\ufffd\ufffd\u0006r\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdr\u0014m\ufffd\rJy$\ufffd\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\|\ufffdr\ufffdP\ufffd\ufffdg\ufffd\u001fk8\ufffd!)F\u027970\ufffd?\u001ad\ufffd\u000eS\ufffd\ufffd\u001d5\ufffd Q\ufffd\u0001(}\ufffd\u0003b\nN\ufffd\ufffd\u0006r\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdr\u0014m\ufffd\rJy$\ufffd\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d78c7f5a0d282c37372369e59f6964b1cfbc1971", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\|\ufffdr\ufffdP\ufffd\ufffdg\ufffd\u001fk8\ufffd!)F\u027970\ufffd?\u001ad\ufffd\u000eS\ufffd\ufffd\u001d5\ufffd Q\ufffd\u0001(}\ufffd\u0003b\nN\ufffd\ufffd\u0006r\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdr\u0014m\ufffd\rJy$\ufffd\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5929, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\|\ufffdr\ufffdP\ufffd\ufffdg\ufffdk8\ufffd!)F\u027970\ufffd?d\ufffdS\ufffd\ufffd5\ufffd Q\ufffd(}\ufffdb\nN\ufffd\ufffdr\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdrm\ufffd\rJy$\ufffd\t\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:5929 \u00b7 (sonde \/ probe)", "target_port_label": "5929 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5929, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\|\ufffdr\ufffdP\ufffd\ufffdg\ufffd\u001fk8\ufffd!)F\u027970\ufffd?\u001ad\ufffd\u000eS\ufffd\ufffd\u001d5\ufffd Q\ufffd\u0001(}\ufffd\u0003b\nN\ufffd\ufffd\u0006r\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdr\u0014m\ufffd\rJy$\ufffd\t\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5929, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:5929 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\|\ufffdr\ufffdP\ufffd\ufffdg\ufffdk8\ufffd!)F\u027970\ufffd?d\ufffdS\ufffd\ufffd5\ufffd Q\ufffd(}\ufffdb\nN\ufffd\ufffdr\ufffdF\ufffd\ufffd\ufffd\ufffd\ufffdrm\ufffd\rJy$\ufffd\t\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "5929 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5929" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
14/07/2026 07:23:55 UTC	TCP	5929 · HTTP	http	Cross-site scripting xss attack · via HTTP:5929 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5929 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5929 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5929 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "61c210b69693b0ab3273adb75c41dcaecdfe1d8a", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455929767925267, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 5929, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d96d45762452ea00aa91a1fcfd3e51bd56d54186", "event_fingerprint": "72af2f341b14f57aec1285de0dc3290a522d6495", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "ac9de17b4b7487232fe79b9d9e3154d9", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5929, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "335ea928609c6b106abaa36c3bbe4ed8928c8633", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5929, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:5929 \u00b7 (tentative d'exploit)", "target_port_label": "5929 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5929, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5929, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5929 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5929\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "5929 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5929" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 20:27:37 UTC	TCP	440 · TLS	tls	Sonde TLS tls probe · via TLS:440 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 440 Chemin / cible — Service TLS Payload �1��v�BEp=�L�?�P��C��- ,Ń�1 �LM�Y��%�C8�\|��;8�a� ��qz��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �1��v�BEp=�L�?�P��C��- ,Ń�1 �LM�Y��%�C8�\|��;8�a� ��qz��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �1��v�BEp=�L�?�P��C��- ,Ń�1 �LM�Y��%�C8�\|��;8�a� ��qz��\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.277407555721975, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 440, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8110585abb3fc3d4af71ffa1d2c7204a1245bce4", "event_fingerprint": "9343145b5d39c3de4c3c51911631119284e91591", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "2be6d9786d76b2603e6fb0ad0213b70a", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 440, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\ufffdv\u000f\ufffdBEp=\ufffd\u0001\u0013L\ufffd?\u0003\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \u0014\ufffd\u001aLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\ufffdv\u000f\ufffdBEp=\ufffd\u0001\u0013L\ufffd?\u0003\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \u0014\ufffd\u001aLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\ufffdv\u000f\ufffdBEp=\ufffd\u0001\u0013L\ufffd?\u0003\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \u0014\ufffd\u001aLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b592784efc538572e4b1b0c6e6872aa2d1ebfd31", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\ufffdv\u000f\ufffdBEp=\ufffd\u0001\u0013L\ufffd?\u0003\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \u0014\ufffd\u001aLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 440, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd1\ufffd\ufffdv\ufffdBEp=\ufffdL\ufffd?\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \ufffdLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:440 \u00b7 (sonde \/ probe)", "target_port_label": "440 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 440, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031\ufffd\ufffdv\u000f\ufffdBEp=\ufffd\u0001\u0013L\ufffd?\u0003\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \u0014\ufffd\u001aLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 440, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:440 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd1\ufffd\ufffdv\ufffdBEp=\ufffdL\ufffd?\ufffdP\ufffd\ufffdC\ufffd\ufffd-\t,\u0143\ufffd1 \ufffdLM\ufffdY\ufffd\ufffd\ufffd%\ufffdC8\ufffd\|\ufffd\ufffd\ufffd;8\ufffda\ufffd\r\ufffd\ufffdqz\ufffd\ufffd\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "440 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "440" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 20:27:37 UTC	TCP	440 · HTTP	http	Cross-site scripting xss attack · via HTTP:440 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 440 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:440 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:440 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apn Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "bc09291a349f76ca1db28927b52c7f3766e47cec", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 398, "payload_entropy": 5.443476301509607, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 440, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "224a1f632563d4804f8cbec9d6dc96fa97e4070f", "event_fingerprint": "b194892cb305dcb33c6d35391e15d88043095903", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "743c2f3eca8ecc7c29ea6f447591abfe", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 440, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0fe223ab842e75734cfd34a223ceb076d6923502", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 440, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "attack_vector": "xss attack \u00b7 via HTTP:440 \u00b7 (tentative d'exploit)", "target_port_label": "440 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 440, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 440, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:440 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:440\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "target_port_label": "440 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "440" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 20:17:51 UTC	TCP	2724 · TLS	tls	Sonde TLS tls probe · via TLS:2724 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2724 Chemin / cible — Service TLS Payload �}�3j��M��l��E��n�n&�ՋP��'J?� ;Y&��J��w��ƾ�<B�"��C\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �}�3j��M��l��E��n�n&�ՋP��'J?� ;Y&��J��w��ƾ�<B�"��C\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �}�3j��M��l��E��n�n&�ՋP��'J?� ;Y&��J��w��ƾ�<B�"��C\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.294032627531158, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 2724, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "259c55a3226cf6b2fb897ea2274c4fd3bf6b9d44", "event_fingerprint": "eec52b5c9a9402176fc90d73aed617ac28cadb4f", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "791da422e8b26dd529a3371b6cebc139", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 2724, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffd\u0000E\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\b\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\u001d\ufffd\ued84\"\ufffd\ufffdC\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffd\u0000E\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\b\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\u001d\ufffd\ued84\"\ufffd\ufffdC\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffd\u0000E\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\b\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\u001d\ufffd\ued84\"\ufffd\ufffdC\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "af39b46557601fa34aff15e1e375e5828bdc4286", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffd\u0000E\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\b\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\u001d\ufffd\ued84\"\ufffd\ufffdC\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 2724, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffdE\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\ufffd\ued84\"\ufffd\ufffdC\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:2724 \u00b7 (sonde \/ probe)", "target_port_label": "2724 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2724, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffd\u0000E\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\b\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\u001d\ufffd\ued84\"\ufffd\ufffdC\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 2724, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2724 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd}\ufffd3j\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffdl\ufffd\ufffdE\ufffd\ufffdn\ufffdn&\ufffd\u054bP\ufffd\ufffd'J?\ufffd ;Y&\ufffd\ufffdJ\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u01be\ufffd<B\ufffd\ued84\"\ufffd\ufffdC\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "2724 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2724" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 20:17:51 UTC	TCP	2724 · HTTP	http	Cross-site scripting xss attack · via HTTP:2724 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2724 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2724 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2724 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "4624a946d6db99b2d709149ebe212b8e0edd2c80", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.456843371876645, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 2724, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "08f6576159212b9021fb4ed09d782b1f1fdd84af", "event_fingerprint": "d588a506339876c6858760ad5ecc35530218fbed", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "2af5144a516895b4c4583641dfd2a67b", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 2724, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a54ae1bdd68094ae41e66c131116f335982c7b1", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 2724, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:2724 \u00b7 (tentative d'exploit)", "target_port_label": "2724 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2724, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 2724, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:2724 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2724\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "2724 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2724" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 18:42:33 UTC	TCP	7632 · TLS	tls	Sonde TLS tls probe · via TLS:7632 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7632 Chemin / cible — Service TLS Payload �q��;��2,f~�pH�k(W^��{�V8q� K�Y�]f�՗Ssք:ޝ��삹Y�M:^�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �q��;��2,f~�pH�k(W^��{�V8q� K�Y�]f�՗Ssք:ޝ��삹Y�M:^�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �q��;��2,f~�pH�k(W^��{�V8q� K�Y�]f�՗Ssք:ޝ��삹Y�M:^�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.327351010155546, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 7632, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "9d2b37a4396225f3a997491943475d6b1f8a8de1", "event_fingerprint": "ec0434c88891f120a3061222a9390bbe56ad8af4", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "682508a25383ef7a905fe96d1db588a2", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 7632, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5082cf093aaf33230b563ca1a7e5d6547f7354a9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7632, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdq\ufffd\ufffd;\ufffd\ufffd2,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\ufffdY\ufffd]f\ufffd\u0557Ss\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:^\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:7632 \u00b7 (sonde \/ probe)", "target_port_label": "7632 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7632, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003q\ufffd\ufffd;\ufffd\ufffd2\u0018\u001f\u001a,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\u0013\u0010\ufffdY\ufffd\u000e]f\ufffd\u0557S\u000fs\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:\b^\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7632, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:7632 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdq\ufffd\ufffd;\ufffd\ufffd2,f~\ufffdpH\ufffdk(W^\ufffd\ufffd{\ufffdV8q\ufffd\r K\ufffdY\ufffd]f\ufffd\u0557Ss\u0584:\u079d\ufffd\ufffd\uc0b9Y\ufffdM:^\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "7632 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7632" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 18:42:33 UTC	TCP	7632 · HTTP	http	Cross-site scripting xss attack · via HTTP:7632 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7632 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7632 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7632 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "167a297bb5b104c477af7d4440186cb9398012ee", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.4507545008418825, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 7632, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "235ae790ccd156001721fde9b27a70b8d84d63fa", "event_fingerprint": "fe7e26764fe308ef284b7b3664fd60d52dbe1858", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "8f49682bf16fc45e3188945eb5b9bb2d", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7632, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8999229e31302b58e4ae61e9ff2eaebe86370af5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7632, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:7632 \u00b7 (tentative d'exploit)", "target_port_label": "7632 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7632, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7632, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7632 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7632\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "7632 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7632" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 17:08:03 UTC	TCP	1839 · TLS	tls	Sonde TLS tls probe · via TLS:1839 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1839 Chemin / cible — Service TLS Payload ��wJV�R��X�ⵣ3Z�Gn��@Ӹ)E�� D��Y:�9�1��!�A��"6��/\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��wJV�R��X�ⵣ3Z�Gn��@Ӹ)E�� D��Y:�9�1��!�A��"6��/\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��wJV�R��X�ⵣ3Z�Gn��@Ӹ)E�� D��Y:�9�1��!�A��"6��/\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.335297915514922, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 1839, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "aa38ccf42b5c33ed136600e4dd4c12ebe68378a9", "event_fingerprint": "bd40e4a9eda33c85e5803fe16a4f3471625287d7", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "5fb72a96311f88432a029a04037c5c39", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 1839, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d63\u00123Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\u0015\ufffd9\ufffd1\ufffd\ufffd!\ufffdA\ufffd\ufffd\ufffd\ufffd\u0006\"6\ufffd\ufffd\u0017\ufffd\u001c\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d63\u00123Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\u0015\ufffd9\ufffd1\ufffd\ufffd!\ufffdA\ufffd\ufffd\ufffd\ufffd\u0006\"6\ufffd\ufffd\u0017\ufffd\u001c\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d63\u00123Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\u0015\ufffd9\ufffd1\ufffd\ufffd!\ufffdA\ufffd\ufffd\ufffd\ufffd\u0006\"6\ufffd\ufffd\u0017\ufffd\u001c\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "81c2ab2a061e9e5bf6a3d2bfe2aec203d880529e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d63\u00123Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\u0015\ufffd9\ufffd1\ufffd\ufffd!\ufffdA\ufffd\ufffd\ufffd\ufffd\u0006\"6\ufffd\ufffd\u0017\ufffd\u001c\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1839, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d633Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\ufffd9\ufffd1\ufffd\ufffd!\ufffdA\ufffd\ufffd\ufffd\ufffd\"6\ufffd\ufffd\ufffd\/\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:1839 \u00b7 (sonde \/ probe)", "target_port_label": "1839 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1839, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d63\u00123Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\u0015\ufffd9\ufffd1\ufffd\ufffd!\ufffdA\ufffd\ufffd\ufffd\ufffd\u0006\"6\ufffd\ufffd\u0017\ufffd\u001c\/\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 1839, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:1839 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdwJV\ufffdR\ufffd\ufffdX\ufffd\u2d633Z\ufffdGn\ufffd\ufffd\ufffd@\u04f8)E\ufffd\ufffd\ufffd \ufffdD\ufffd\ufffdY:\ufffd9\ufffd1\ufffd\ufffd!\ufffdA*\ufffd\ufffd\ufffd\ufffd\"6\ufffd\ufffd\ufffd\/\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "1839 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1839" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 17:08:03 UTC	TCP	1839 · HTTP	http	Cross-site scripting xss attack · via HTTP:1839 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1839 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1839 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1839 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "3e022ef94f0a007c823c1a746e60bb78ca87cae4", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.452711190193076, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 1839, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d93de120c0baecb31e18a7f08adf7d9aad97d37e", "event_fingerprint": "0c55793b8586539ea2f6760fdea81059ea6e2a8f", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "d2fdadc9d7a9a398e5cac94111e9c905", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 1839, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "78643969ba4345bd5c569ecf7bbf9d2962a371b0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1839, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:1839 \u00b7 (tentative d'exploit)", "target_port_label": "1839 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1839, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 1839, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:1839 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1839\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "1839 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1839" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 16:39:44 UTC	TCP	5202 · TLS	tls	Sonde TLS tls probe · via TLS:5202 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5202 Chemin / cible — Service TLS Payload ��Q7�Z��8��O%ؽ+��<��f�ۭʵ\Z ?�k��hμp�jJ��i��<�P�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��Q7�Z��8��O%ؽ+��<��f�ۭʵ\Z ?�k��hμp�jJ��i��<�P�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��Q7�Z��8��O%ؽ+��<��f�ۭʵ\Z ?�k��hμp�jJ��i��<�P�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.3152029820331315, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 5202, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cf8f77df3ccd910ea7d952ff94b5c80c5406b829", "event_fingerprint": "5cf7ad87ad1037f66b7fa0ecaf719e8cc9d9a274", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "0aa79a7d7f83a4a1f0c0dad3e753d3d7", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 5202, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ7\ufffdZ\ufffd\u001b\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u001a\u001e\u03bcp\ufffdjJ\ufffd\ufffdi\u0000\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ7\ufffdZ\ufffd\u001b\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u001a\u001e\u03bcp\ufffdjJ\ufffd\ufffdi\u0000\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ7\ufffdZ\ufffd\u001b\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u001a\u001e\u03bcp\ufffdjJ\ufffd\ufffdi\u0000\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b5b9f3c0da2e0409a1706d3e2da012be319d2170", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ7\ufffdZ\ufffd\u001b\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u001a\u001e\u03bcp\ufffdjJ\ufffd\ufffdi\u0000\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5202, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdQ7\ufffdZ\ufffd\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u03bcp\ufffdjJ\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:5202 \u00b7 (sonde \/ probe)", "target_port_label": "5202 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5202, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ7\ufffdZ\ufffd\u001b\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u001a\u001e\u03bcp\ufffdjJ\ufffd\ufffdi\u0000\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5202, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:5202 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdQ7\ufffdZ\ufffd\ufffd8\ufffd\ufffdO%\u063d+\ufffd\ufffd<\ufffd\ufffdf\ufffd\u06ed\u02b5\\Z ?\ufffdk\ufffd\ufffdh\u03bcp\ufffdjJ\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffdP\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "5202 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5202" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 16:39:44 UTC	TCP	5202 · HTTP	http	Cross-site scripting xss attack · via HTTP:5202 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5202 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5202 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5202 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "7dc42de6a175c76dcd013b0f43a567f8e9429674", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.451315597926912, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 5202, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "878464e9e1936548059b2bcfd0db1b34b17ac359", "event_fingerprint": "e07c43d8565119fc2a51f83d05e28fcba6d047a5", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "56640ba5ca786b0b6f023610fd5c6d0c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5202, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ac107a015438c03660e93e3fe9cec61faec7f7fb", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5202, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:5202 \u00b7 (tentative d'exploit)", "target_port_label": "5202 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5202, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5202, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5202 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5202\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "5202 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5202" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 16:22:06 UTC	TCP	31 · TLS	tls	Sonde TLS tls probe · via TLS:31 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 31 Chemin / cible — Service TLS Payload �J�v��}@/�w\|tHTA잦�O��w��u� �/�gO�+e�mE��W$,;@n�yJS L�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �J�v��}@/�w\|tHTA잦�O��w��u� �/�gO�+e�mE��W$,;@n�yJS L�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �J�v��}@/�w\|tHTA잦�O��w��u� �/�gO�+e�mE��W$,;@n�yJS L�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.28464638132677, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 31, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a4436a05600f928f5ddf2ed03c6b2bd8ccc68528", "event_fingerprint": "bd504c476242114810556fd772a83106e5e1d3cc", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "f30ca00b0ff0a36f00ba8498c7a304b2", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 31, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003J\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\u0012\ufffd\ufffdu\ufffd \u0016\ufffd\/\ufffdgO\ufffd+e\u0017\ufffd\u0017mE\ufffd\ufffdW$,\u037e@n\ufffdyJ\u0002S\tL\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003J\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\u0012\ufffd\ufffdu\ufffd \u0016\ufffd\/\ufffdgO\ufffd+e\u0017\ufffd\u0017mE\ufffd\ufffdW$,\u037e@n\ufffdyJ\u0002S\tL\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003J\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\u0012\ufffd\ufffdu\ufffd \u0016\ufffd\/\ufffdgO\ufffd+e\u0017\ufffd\u0017mE\ufffd\ufffdW$,\u037e@n\ufffdyJ\u0002S\tL\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a70133ef342e9446adcc320efda47ddcacc47e8e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003J\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\u0012\ufffd\ufffdu\ufffd \u0016\ufffd\/\ufffdgO\ufffd+e\u0017\ufffd\u0017mE\ufffd\ufffdW$,\u037e@n\ufffdyJ\u0002S\tL\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 31, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdJ\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdu\ufffd \ufffd\/\ufffdgO\ufffd+e\ufffdmE\ufffd\ufffdW$,\u037e@n\ufffdyJS\tL\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:31 \u00b7 (sonde \/ probe)", "target_port_label": "31 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 31, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003J\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\u0012\ufffd\ufffdu\ufffd \u0016\ufffd\/\ufffdgO\ufffd+e\u0017\ufffd\u0017mE\ufffd\ufffdW$,\u037e@n\ufffdyJ\u0002S\tL\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 31, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:31 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdJ\ufffdv\ufffd\ufffd\ufffd\ufffd}@\/\ufffdw\|tHTA\uc7a6\ufffdO\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdu\ufffd \ufffd\/\ufffdgO\ufffd+e\ufffdmE\ufffd\ufffdW$,\u037e@n\ufffdyJS\tL\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "31 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "31" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 16:22:06 UTC	TCP	31 · HTTP	http	Cross-site scripting xss attack · via HTTP:31 · (tentative d'exploit)	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:31 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:31 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "82788c7a67a432a55b9ee603979abf3b7742d4ce", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 397, "payload_entropy": 5.441380393204638, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 31, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "746690110339e3a745970467071182067c5b4808", "event_fingerprint": "146bb906c3628e3132a2cf9029411d947e7f0645", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "b01f71ff0b1bcdeccf007921ac3b2dd3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 31, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20e5cd0d0fb9d80b249cab98b2978d2fa3b8881a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 31, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "attack_vector": "xss attack \u00b7 via HTTP:31 \u00b7 (tentative d'exploit)", "target_port_label": "31 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 31, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 31, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:31 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "target_port_label": "31 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "31" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 15:43:01 UTC	TCP	7171 · TLS	tls	Sonde TLS tls probe · via TLS:7171 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7171 Chemin / cible — Service TLS Payload ��豑k��ܗ��b�z��޸=��h� /�1��afs�,3[�9�Wp�v�:��O \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��豑k��ܗ��b�z��޸=��h� /�1��afs�,3[�9�Wp�v�:��O \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��豑k��ܗ��b�z��޸=��h� /�1��afs�,3[�9�Wp�v�:��O \�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.312831726876946, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 7171, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6673458f1d81c2f14a7eab46642f5b8acf69a59c", "event_fingerprint": "2ddd5695b4e20a8840d6c0126ce4dcfc6cb64ae7", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "5a7776e635c5178f57672c40507362d1", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 7171, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001c\u8c51\u0002k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\u001d\u0001\ufffd\ufffdh\ufffd \/\ufffd\u00101\ufffd\ufffd\u0010afs\ufffd,\b3[\ufffd9\ufffdWp\u001c\ufffdv\u000e\ufffd:\ufffd\ufffdO\u0014\r\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001c\u8c51\u0002k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\u001d\u0001\ufffd\ufffdh\ufffd \/\ufffd\u00101\ufffd\ufffd\u0010afs\ufffd,\b3[\ufffd9\ufffdWp\u001c\ufffdv\u000e\ufffd:\ufffd\ufffdO\u0014\r\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001c\u8c51\u0002k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\u001d\u0001\ufffd\ufffdh\ufffd \/\ufffd\u00101\ufffd\ufffd\u0010afs\ufffd,\b3[\ufffd9\ufffdWp\u001c\ufffdv\u000e\ufffd:\ufffd\ufffdO\u0014\r\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1150f8a7215e92f254a8abba4bebeca2643342c0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001c\u8c51\u0002k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\u001d\u0001\ufffd\ufffdh\ufffd \/\ufffd\u00101\ufffd\ufffd\u0010afs\ufffd,\b3[\ufffd9\ufffdWp\u001c\ufffdv\u000e\ufffd:\ufffd\ufffdO\u0014\r\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7171, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u8c51k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\ufffd\ufffdh\ufffd \/\ufffd1\ufffd\ufffdafs\ufffd,3[\ufffd9\ufffdWp\ufffdv\ufffd:\ufffd\ufffdO\r\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:7171 \u00b7 (sonde \/ probe)", "target_port_label": "7171 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7171, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001c\u8c51\u0002k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\u001d\u0001\ufffd\ufffdh\ufffd \/\ufffd\u00101\ufffd\ufffd\u0010afs\ufffd,\b3[\ufffd9\ufffdWp\u001c\ufffdv\u000e\ufffd:\ufffd\ufffdO\u0014\r\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 7171, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:7171 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u8c51k\ufffd\ufffd\ufffd\ufffd\u0717\ufffd\ufffd\ufffdb\ufffdz\ufffd\ufffd\u07b8=\ufffd\ufffdh\ufffd \/\ufffd1\ufffd\ufffdafs\ufffd,3[\ufffd9\ufffdWp\ufffdv\ufffd:\ufffd\ufffdO\r\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "7171 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7171" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 15:43:01 UTC	TCP	7171 · HTTP	http	Cross-site scripting xss attack · via HTTP:7171 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7171 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7171 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7171 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "6a3d9297703d4d3cdd82d01e7dacc9da9082fd84", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.449025287969971, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 7171, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6ab36e6d4175c1cd125e623fb7cbc0e96927a770", "event_fingerprint": "23fdf79eca4552c953047d2ba3169155db230090", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "69e9af0e2aebb394a1fc7c6f203181d6", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7171, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7bc188e9eedc8b74a755b56ff16c51b3e936eb8e", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7171, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:7171 \u00b7 (tentative d'exploit)", "target_port_label": "7171 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7171, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7171, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7171 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7171\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "7171 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7171" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 15:32:12 UTC	TCP	452 · TLS	tls	Sonde TLS tls probe · via TLS:452 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 452 Chemin / cible — Service TLS Payload �1wC�,��T��iPD0Nhv �h�N�o��~, ��˗c��\|њl��Bw�1}��6Jh�MnQ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �1wC�,��T��iPD0Nhv�h�N�o��~, ��˗c��\|њl��Bw�1}��6Jh�MnQ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �1wC�,��T��iPD0Nhv �h�N�o��~, ��˗c��\|њl��Bw�1}��6Jh�MnQ\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.312373067391759, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 452, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "055d8b2f0eb392eacdd9ccffd6575298bed1b956", "event_fingerprint": "da4e53ec4a711ce8128a95a40d2c338b0a1de61f", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "5c86751b407f110ef70c1252793ba3d3", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 452, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031wC\ufffd,\b\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\u000b\ufffdh\u0011\ufffd\u0005N\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\u0011\ufffd\|\u0016\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6J\u001dh\ufffdMnQ\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031wC\ufffd,\b\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\u000b\ufffdh\u0011\ufffd\u0005N\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\u0011\ufffd\|\u0016\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6J\u001dh\ufffdMnQ\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031wC\ufffd,\b\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\u000b\ufffdh\u0011\ufffd\u0005N\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\u0011\ufffd\|\u0016\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6J\u001dh\ufffdMnQ\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f8b66bb41094ae1e9e1e32f504eca6f05c3f43db", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031wC\ufffd,\b\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\u000b\ufffdh\u0011\ufffd\u0005N\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\u0011\ufffd\|\u0016\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6J\u001dh\ufffdMnQ\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 452, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd1wC\ufffd,\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\ufffdh\ufffdN\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\ufffd\|\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6Jh\ufffdMnQ\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:452 \u00b7 (sonde \/ probe)", "target_port_label": "452 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 452, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00031wC\ufffd,\b\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\u000b\ufffdh\u0011\ufffd\u0005N\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\u0011\ufffd\|\u0016\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6J\u001dh\ufffdMnQ\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 452, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:452 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd1wC\ufffd,\ufffd\ufffd\ufffdT\ufffd\ufffdiPD0Nhv\ufffdh\ufffdN\ufffdo\ufffd\ufffd~, \ufffd\ufffd\ufffd\u02d7c\ufffd\ufffd*\|\u045al\ufffd\ufffdBw\ufffd1}\ufffd\ufffd6Jh\ufffdMnQ\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "452 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "452" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 15:32:12 UTC	TCP	452 · HTTP	http	Cross-site scripting xss attack · via HTTP:452 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 452 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:452 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:452 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apn Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "02c26fba0153397e7abd30c3cf30b2fd5bc287c8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 398, "payload_entropy": 5.4512304882613165, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 452, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "5780163dccc47294e8a76ef6242713ca591bfa41", "event_fingerprint": "d57b5a0513b91bf7cbf8ded398929013aabe5f78", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "1e2e6bfff61b371c7f5b54ed2dde23d6", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 452, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3b8707ccc102382c0b7fffb348ccadb957bd53f", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 452, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "attack_vector": "xss attack \u00b7 via HTTP:452 \u00b7 (tentative d'exploit)", "target_port_label": "452 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 452, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 452, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:452 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:452\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "target_port_label": "452 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "452" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
13/07/2026 15:18:18 UTC	TCP	3974 · TLS	tls	Sonde TLS tls probe · via TLS:3974 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3974 Chemin / cible — Service TLS Payload ��g�z-��R�FW\��g��!K�"8��{� +�1��%9x�rӭ�� "8Hn`��1��v\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��g�z-��R�FW\��g��!K�"8��{� +�1��%9x�rӭ�� "8Hn`��1��v\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��g�z-��R�FW\��g��!K�"8��{� +�1��%9x�rӭ�� "8Hn`��1��v\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.278999022451442, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 3974, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "79e96f139662bbc83cfd8ba18c05910fbc8e2386", "event_fingerprint": "40562958cf138f1f08977ef9444fa2b2d28efac0", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "ddd1420197b0316445d84641a7f0a649", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 3974, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\ufffdg\ufffdz-\ufffd\ufffd\u0002R\ufffdFW\u0014\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd\u001c%9x\ufffdr\u04ed\u0007\ufffd\ufffd\ufffd\ufffd\n\"8Hn`\ufffd\ufffd\u001b1\ufffd\ufffdv\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\ufffdg\ufffdz-\ufffd\ufffd\u0002R\ufffdFW\u0014\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd\u001c%9x\ufffdr\u04ed\u0007\ufffd\ufffd\ufffd\ufffd\n\"8Hn`\ufffd\ufffd\u001b1\ufffd\ufffdv\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\ufffdg\ufffdz-\ufffd\ufffd\u0002R\ufffdFW\u0014\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd\u001c%9x\ufffdr\u04ed\u0007\ufffd\ufffd\ufffd\ufffd\n\"8Hn`\ufffd\ufffd\u001b1\ufffd\ufffdv\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b065247841970af61c86ebd94307623fb4e2a873", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\ufffdg\ufffdz-\ufffd\ufffd\u0002R\ufffdFW\u0014\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd\u001c%9x\ufffdr\u04ed\u0007\ufffd\ufffd\ufffd\ufffd\n\"8Hn`\ufffd\ufffd\u001b1\ufffd\ufffdv\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 3974, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdg\ufffdz-\ufffd\ufffdR\ufffdFW\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd%9x\ufffdr\u04ed\ufffd\ufffd\ufffd\ufffd\n\"8Hn`\ufffd\ufffd1\ufffd\ufffdv\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:3974 \u00b7 (sonde \/ probe)", "target_port_label": "3974 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3974, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0005\ufffdg\ufffdz-\ufffd\ufffd\u0002R\ufffdFW\u0014\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd\u001c%9x\ufffdr\u04ed\u0007\ufffd\ufffd\ufffd\ufffd\n\"8Hn`\ufffd\ufffd\u001b1\ufffd\ufffdv\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 3974, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:3974 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdg\ufffdz-\ufffd\ufffdR\ufffdFW\\\ufffd\ufffd\ufffdg\ufffd\ufffd!K\ufffd\"8\ufffd\ufffd{\ufffd +\ufffd1\ufffd\ufffd%9x\ufffdr\u04ed\ufffd\ufffd\ufffd\ufffd\n*\"8Hn`\ufffd\ufffd1\ufffd\ufffdv\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "3974 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3974" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 15:18:18 UTC	TCP	3974 · HTTP	http	Cross-site scripting xss attack · via HTTP:3974 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3974 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3974 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3974 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "0730d979640984401a1500f486141d740610859c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.45050421144311, "port_category": "registered", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 3974, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "185afd414c12d08883a8f1daa72313cc260aacad", "event_fingerprint": "fb7dac693c42307b6b7b9d2092e9c5a88447a230", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "461758ee897c1b2dca69fb46532d0bb2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3974, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "749c0ca823e54b7a8ce753f34ff40392d89de0cc", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 3974, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:3974 \u00b7 (tentative d'exploit)", "target_port_label": "3974 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3974, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 3974, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:3974 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3974\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "3974 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3974" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
13/07/2026 15:15:47 UTC	TCP	3 · TLS	tls	Sonde TLS tls probe · via TLS:3 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3 Chemin / cible — Service TLS Payload �d;hz��q��Z�i�EX�ZX�\z��Ex2�>�> A�d�.j}�7�`HlJ�z��2Ѩo;(� �<\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �d;hz��q��Z�i�EX�ZX�\z��Ex2�>�> A�d�.j}�7�`HlJ�z��2Ѩo;(� �<\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �d;hz��q��Z�i�EX�ZX�\z��Ex2�>�> A�d�.j}�7�`HlJ�z��2Ѩo;(� �<\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.297721797429286, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "tls", "app_proto": "tls", "asn": 211486, "country": "BG", "dst_port": 3, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e7f268b93268cbd4ebd24a7ba249c9ed5db3b500", "event_fingerprint": "a09a719ae27e3a9f24d8b0788cbb6f5d7ff06bfa", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "7acd2d5c90582ddde459fc34b52a5a78", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 3, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d;h\u001ez\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\u001d\ufffd>\ufffd> A\ufffdd\ufffd.\u0014j}\ufffd7\u000f\ufffd`HlJ\ufffdz\ufffd\ufffd\u001c\ufffd2\u0468o;(\ufffd\n\ufffd<\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d;h\u001ez\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\u001d\ufffd>\ufffd> A\ufffdd\ufffd.\u0014j}\ufffd7\u000f\ufffd`HlJ\ufffdz\ufffd\ufffd\u001c\ufffd2\u0468o;(\ufffd\n\ufffd<\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d;h\u001ez\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\u001d\ufffd>\ufffd> A\ufffdd\ufffd.\u0014j}\ufffd7\u000f\ufffd`HlJ\ufffdz\ufffd\ufffd\u001c\ufffd2\u0468o;(\ufffd\n\ufffd<\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "570519bc4a5a6e362ed3086424ae944d2aa5c4c4", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d;h\u001ez\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\u001d\ufffd>\ufffd> A\ufffdd\ufffd.\u0014j}\ufffd7\u000f\ufffd`HlJ\ufffdz\ufffd\ufffd\u001c\ufffd2\u0468o;(\ufffd\n\ufffd<\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 3, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdd;hz\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\ufffd>\ufffd> A\ufffdd\ufffd.j}\ufffd7\ufffd`HlJ\ufffdz\ufffd\ufffd\ufffd2\u0468o;(\ufffd\n\ufffd<\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:3 \u00b7 (sonde \/ probe)", "target_port_label": "3 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003d;h\u001ez\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\u001d\ufffd>\ufffd> A\ufffdd\ufffd.\u0014j}\ufffd7\u000f\ufffd`HlJ\ufffdz\ufffd\ufffd\u001c\ufffd2\u0468o;(\ufffd\n\ufffd<\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 3, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:3 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdd;hz\ufffd\ufffdq\ufffd\ufffdZ\ufffdi\ufffdEX\ufffdZX\ufffd\\z\ufffd\ufffdEx2\ufffd>\ufffd> A\ufffdd\ufffd.j}\ufffd7\ufffd`HlJ\ufffdz\ufffd\ufffd\ufffd2\u0468o;(\ufffd\n\ufffd<\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "3 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/07/2026 15:15:47 UTC	TCP	3 · HTTP	http	Cross-site scripting xss attack · via HTTP:3 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng, Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "1a6eea91c238f7186832074e357b3b2d489d355e", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 396, "payload_entropy": 5.438797436521336, "port_category": "well_known", "org": "Alferov Aleksey Aleksandrovich", "service": "http", "app_proto": "http", "asn": 211486, "country": "BG", "dst_port": 3, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "50f602e4cf022529a94211909e26af954522076c", "event_fingerprint": "ab793678829aabbf34ba5f37200c6b7acae3f17f", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "BG", "asn": 211486, "org": "Alferov Aleksey Aleksandrovich", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "e766a79dd07c06f46740ecd3869d9cea", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko)", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko)", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko)", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7f5bba8b34cffbeca5b8a60e3caea466edf7e35b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 3, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko)", "attack_vector": "xss attack \u00b7 via HTTP:3 \u00b7 (tentative d'exploit)", "target_port_label": "3 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 3, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:3 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko)", "target_port_label": "3 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }

93.152.208.38

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence