|
|
TCP |
8554 · RTSP ALT
|
rtsp-alt
|
Sonde RTSP
rtsp probe · via RTSP ALT:8554 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RTSP-ALT
WAF
—
Recommandation
Surveiller
Tags
net_rtsp_probe
rtsp_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8554
Chemin / cible
—
Service
RTSP ALT
Payload
OPTIONS rtsp://62.3.50.33:8554/Streaming/Channels/101 RTSP/1.0 CSeq: 1 User-Agent: Lavf62.10.101
Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0382
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
HTTP OPTIONS method
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS rtsp://62.3.50.33:8554/Streaming/Channels/101 RTSP/1.0
CSeq: 1
User-Agent: Lavf62.10.101
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 102,
"payload_entropy": 5.060468082903735,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "rtsp-alt",
"app_proto": "rtsp-alt",
"asn": 3320,
"country": "DE",
"dst_port": 8554,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 47,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5049ad9e8ce50e4704e2a0f7def474f244a0ffe8",
"event_fingerprint": "dda900f8f0700ffe1f2b62a0cdf29556ed40edf9",
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 83,
"precision_signals": [
"pat-0382",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0382",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0420"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"HTTP OPTIONS method"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0420"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "rtsp-alt",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "72205b63f3b9c43c43ffe19cce509cce",
"path_pattern_hash": "b1dd2a100b4c2489a836875293183168"
},
"target_context": {
"dst_port": 8554,
"service": "rtsp-alt",
"service_name": "rtsp-alt",
"risk_score": 47
},
"payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101\r\n\r\n",
"request_sample": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101\r\n\r\n",
"payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"evidence": {
"request_sample": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101\r\n\r\n",
"payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cf766f0349f09b12676428a25e7bba44776d7db",
"protocol_details": {
"payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"port": 8554,
"service": "rtsp-alt",
"service_label_fr": "RTSP ALT"
},
"evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"attack_vector": "rtsp probe \u00b7 via RTSP ALT:8554 \u00b7 (sonde \/ probe)",
"target_port_label": "8554 \u00b7 RTSP ALT",
"emulator_service": "rtsp-alt",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "rtsp-alt",
"service_label_fr": "RTSP ALT",
"dst_port": 8554,
"protocol_emulated": true,
"tags_summary": [
"pat-0382",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0382",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp-alt",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"port": 8554,
"service": "rtsp-alt",
"service_label_fr": "RTSP ALT"
},
"attack_vector": "rtsp probe \u00b7 via RTSP ALT:8554 \u00b7 (sonde \/ probe)",
"evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:8554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"target_port_label": "8554 \u00b7 RTSP ALT",
"emulator_service": "rtsp-alt",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp_alt",
"service_banner": "honeypot-rtsp-alt",
"service_os": "linux",
"dst_port": "8554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rtsp_probe",
"rtsp_probe"
]
}
|
|
|
TCP |
554 · RTSP
|
rtsp
|
Sonde RTSP
rtsp probe · via RTSP:554 · (sonde / probe)
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Surveiller
Tags
net_rtsp_probe
rtsp_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
OPTIONS rtsp://62.3.50.33:554/Streaming/Channels/101 RTSP/1.0 CSeq: 1 User-Agent: Lavf62.10.101
Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 47
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0382
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
HTTP OPTIONS method
User-Agent
—
Règles WAF
—
Payload (extrait)
OPTIONS rtsp://62.3.50.33:554/Streaming/Channels/101 RTSP/1.0
CSeq: 1
User-Agent: Lavf62.10.101
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 101,
"payload_entropy": 5.030294250821974,
"port_category": "well_known",
"org": "Deutsche Telekom AG",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 3320,
"country": "DE",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 47,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c612347518e049ce96c448df76dc171f725494ef",
"event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9",
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0382",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0382",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0420"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"HTTP OPTIONS method"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0420"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9c565b1403d6514df2586ff9dd9d71d8",
"path_pattern_hash": "b1dd2a100b4c2489a836875293183168"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 47
},
"payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101\r\n\r\n",
"request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101\r\n\r\n",
"payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"evidence": {
"request_sample": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101\r\n\r\n",
"payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60580c9980c7f395a561e50353538c7e3741f18d",
"protocol_details": {
"payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0382",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0382",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "rtsp probe \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)",
"evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33:554\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.10.101",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rtsp_probe",
"rtsp_probe"
]
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/onvif1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/onvif1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 111,
"payload_entropy": 5.091568215152702,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "327f3f53cd0d9c8478d84461d2edf10f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "27c9bd7ef578b4efb5f3294d4d037d7e7f8d1ce2",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/onvif2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/onvif2 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 111,
"payload_entropy": 5.102785444862941,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "50a4d7eb69c78ff4b6395011ccec3348",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "630c227c7839fd3720f978704b04f1e7c269fd12",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/main RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/main RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 109,
"payload_entropy": 5.052440386401587,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8e6441eb63dea06ba5d917557a99f2e2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf155f521527d20533045f6f518586efbd058881",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"behavior_alert_count": 2,
"behavior_priority": 72
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/sub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/sub RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 108,
"payload_entropy": 5.082187860438359,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fa9a7d3fce58f784986c9d70f02eb089",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e819c3a65d1edb7acf5eabc470fad2c868267969",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/primary RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/primary RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 112,
"payload_entropy": 5.073771562141187,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ac7c5d314b233b95badf11b61c348952",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5816cb4a8fc54cfc22e7a65623ec447ca5e52280",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/secondary RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/secondary RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 114,
"payload_entropy": 5.05866894591256,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6f3e2910f0277ee9dd23c7dcde90a8e4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc4fbfe686e87955a2ebe233f35303d3728f53ea",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/stream RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/stream RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 111,
"payload_entropy": 5.040798196923875,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ad42264ff5eef51c23f89259bfaf6734",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a746a5e3170ae5b2c491692b6f8871ef2438447c",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/stream0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/stream0 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 112,
"payload_entropy": 5.037165620443777,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ad945f2788f7842ecc3f824fd184ef0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7dd165872d20a736c4a0f36760e0c7c99fc09656",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h264.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h264.sdp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 113,
"payload_entropy": 5.101937048161749,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f7988b361e23b10cd0a10d374be28683",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70fb1e224ea31d04d03759df755a331e0eb823a7",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h265.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h265.sdp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 113,
"payload_entropy": 5.077557512744373,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "38b45df01c0bb4dcd7f182723775ad2e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ae0cf18676e701492913c6225f7ce13585a2375",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/live_h264.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/live_h264.sdp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 118,
"payload_entropy": 5.163860351542413,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d9b9f6b28e5abf1ade92d622801e6e1a",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ad1ad2567572e19b89c4c7156811c0daa48f58f",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/1/h264major RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/1/h264major RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 116,
"payload_entropy": 5.159343746576924,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e935491b5ccadf8aa079d39dad437f20",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8cb2528a4f1f15f90b4fc259886bcbab1370816b",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/1/h264minor RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/1/h264minor RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 116,
"payload_entropy": 5.13245223382896,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "519b49e30606d9b7d166e04f5cbbb49b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc3a847c1f99d9724f5f00d88d300b6a4c1214e2",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/0/h264major RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/0/h264major RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 116,
"payload_entropy": 5.156201264020024,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "28693a8c61d4353908a9aa808c5644bd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79317d0690689214ff9b28d08d4b13904706d2ee",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/0/h264minor RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/0/h264minor RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 116,
"payload_entropy": 5.129309751272062,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "18926a6785ed2016fc1aa3b036f6a61d",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a0a9a2df7794f073b4dd2a7e6447b1e2a74cc74",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/ch0_0.h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ch0_0.h264 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 115,
"payload_entropy": 5.122572618234153,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0c2891b99631f30357532d3bdcca5a35",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "996365fdedc4c68d3b4ca17ad51f2b7f1bb41233",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/ch0_1.h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ch0_1.h264 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 115,
"payload_entropy": 5.128268461991141,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b4dd80135348988fc54880164a69d3d5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af10e131866e858099fc0d3e3b5395ed98dbc644",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/av0_0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/av0_0 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 110,
"payload_entropy": 5.0708021107006696,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cc60bb83d8f04951ef3449c737093ebc",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c6a4ebb238b2574f63e0a6c82e0b0a694606e93",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/av0_1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/av0_1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 110,
"payload_entropy": 5.076756856446611,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d29b87ba6707b49ef945b4aedda7f081",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc0c90c6acc57557aa909b47939c300abc432e12",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/live0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/live0 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 110,
"payload_entropy": 5.057076883388607,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b9801514d1fd7cc1d587cfe5466ea2f2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a21497a96509a8bf850923ab963a02745f69c44",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/live1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/live1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 110,
"payload_entropy": 5.060390774084973,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3e42a0877d3836f2d34786c7e0a9079c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5bd1b575aa85dd8d2bb061008112764670525198",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/onvif-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/onvif-media/media.amp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 126,
"payload_entropy": 5.111430453022248,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "56936de19805c8d9e8c49ac877653cb2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f498b4e1384de4689147e6438d71151e3891de4",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/videoMain RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/videoMain RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 114,
"payload_entropy": 5.094632678106507,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b7da2f3db851fa7d67752efd502f3103",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b4184cd64256721ec3b8b7e3700628bf017df9d",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/videoSub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/videoSub RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 113,
"payload_entropy": 5.121403693650418,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "303abfec5d0014bc3c3f626021320256",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f0f8df400dac6505c1fa77bbd2ffcbb743b1ec8",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h264 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 109,
"payload_entropy": 5.103904977910182,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ce6f66f3ff6ba366291b1a65b7ca9e7",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f700124d2fbed9829e019538b3a8709278c99cee",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h265 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h265 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 109,
"payload_entropy": 5.078630780642627,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d4e4a0fe71434c719ea29d5a8c2e834f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1afe16ba55e93f3bda80b6bca0c621ea6f2e96b5",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/stream1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/stream1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 112,
"payload_entropy": 5.040420334520565,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25c330c8ad0d44579af9051f8aea8536",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15c6b6b615fc44d7b8af2f499eb7a7f3fe9dbbae",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/stream2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/stream2 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 112,
"payload_entropy": 5.051537410394106,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1bf74d5bb0436dc6d61adb9a1c9371ed",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86833ac4282f79b5b3d8af4120212a48b9e0d121",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/live/ch0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/live/ch0 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 113,
"payload_entropy": 5.075215366669236,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d87f817a44eab878dd6e8b3b48a19bfd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61a533e8743495e82b8c2c85a0db771f9b52239d",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/live/ch1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/live/ch1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 113,
"payload_entropy": 5.078441277966584,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "15f747a5faebad92fe2381073cb63503",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfd64c09cd7ee95b10deedfe333161f2fd7245e5",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/video.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/video.sdp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 114,
"payload_entropy": 5.064721190964252,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "062df27223eb47a90cda2ddc2b5b3b15",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66db89b0a9f856a90c57121d9558d531c07aab5e",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/ch0_1.264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ch0_1.264 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 114,
"payload_entropy": 5.118148937589109,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "861bbb10a8c69eef9f728e2ee3e8fd87",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43905785c42e3e122e7141731aec8b2b3ece72c6",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/axis-media/media.amp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 125,
"payload_entropy": 5.070790566632789,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cde96ce90fe5893250a409365c1095b4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "275ba43689d33f24b052a5ae78726d0c0c720e45",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/mpeg4/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/mpeg4/media.amp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 120,
"payload_entropy": 5.078853597697392,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4946d9cf21b80e3796459b69c4a134aa",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7def508ccd1938e15873d4aafb2b40be527817e1",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h264/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h264/media.amp RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 119,
"payload_entropy": 5.127371264593497,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0e070de25b00dea45976dc4f3ea4b13c",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df702a1ffacca455f821428e6405df3e6acbb743",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h264Preview_01_main RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h264Preview_01_main RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 124,
"payload_entropy": 5.202923739959547,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "568d0a95de5a65a66ceb2f7d5d671568",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a9a28f5b98f00829f4d8cba6bca63df373801af",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/h264Preview_01_sub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/h264Preview_01_sub RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 123,
"payload_entropy": 5.232733645496024,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "114aa83bda8b254823c58bc69f79fed3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a5daa6df66f545784c248203e4287b0baa10d16a",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/bcs/channel0_main.bcs RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/bcs/channel0_main.bcs RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 126,
"payload_entropy": 5.102729438002728,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d4c9ece0fb8bfe0dcc717af67ff30d25",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef62acea53a3967688ebd20c9a675820c6e2d5e8",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/bcs/channel0_sub.bcs RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/bcs/channel0_sub.bcs RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 125,
"payload_entropy": 5.107047118437905,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b1b77528f140831944256257c1d4fbe",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "18bcb747e2a639397c5905443960f5b9941e5ea0",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/unicast/c1/s1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/unicast/c1/s1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 118,
"payload_entropy": 5.0191951282924405,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "500edc772b6a28d4c6bcfdfcb47090df",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8f626b0ada3f8c3c5a81f4eaa1d519865a73524",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/unicast/c1/s2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/unicast/c1/s2 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 118,
"payload_entropy": 5.032836149262244,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9b40fe68c47442b1acc5695311ba1e32",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "688a7fe06add98376438da44f19e3c0e5a25b291",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/media/video1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/media/video1 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 117,
"payload_entropy": 5.087513951923844,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3332ab81ea0a3f08e4d30425bbbd2c5b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75141ce92cd2da06a2f040e87ab55ca2d2c7289d",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/media/video2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/media/video2 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 117,
"payload_entropy": 5.09815593908484,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a66cb41ed7830e50cf1e80b535095038",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf030133261a2ef237dee0674e2e1bc137518e4e",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/102 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/102 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 127,
"payload_entropy": 5.064583094869133,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "26c9fcc8d614ccf3714a92e898591afb",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "690e0c2609c9acf0db3156b1e91aed5233b807f5",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/201 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/201 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 127,
"payload_entropy": 5.064583094869133,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6afc0c22a73f42db7fee618dfd761e3",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1129376b378c23daeff83f8a328b1e33e23c4b4d",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/201 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/202 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/202 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 127,
"payload_entropy": 5.0684431342051415,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "640af66e9da223087219a3a8eed4dae4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e762f3f0c1247a6a47ea42ea9f9459dc647e6a8",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/202 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/ISAPI/Streaming/channels/101 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sd
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ISAPI/Streaming/channels/101 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sd
Requête brute (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ISAPI/Streaming/channels/101 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 133,
"payload_entropy": 5.058438953391726,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ca7be7b9a744d9eaaf948e602863c6f2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b919b2e2b230cfa1bc41a5fd8eb79329aee81ad",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
5001 · UPNP TCP
|
upnp-tcp
|
Scan de ports
port scan syn · via UPNP TCP:5001 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
DESCRIBE rtsp://62.3.50.33:5001/ISAPI/Streaming/channels/102 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sd
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
RTSP protocol
RTSP DESCRIBE
User-Agent
—
Règles WAF
—
Payload (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ISAPI/Streaming/channels/102 RTSP/1.0
CSeq: 1
User-Agent: RTSP-Scanner
Accept: application/sd
Requête brute (extrait)
DESCRIBE rtsp://62.3.50.33:5001/ISAPI/Streaming/channels/102 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 133,
"payload_entropy": 5.070541513349898,
"port_category": "registered",
"org": "Deutsche Telekom AG",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 3320,
"country": "DE",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"RTSP protocol",
"RTSP DESCRIBE"
],
"pattern_ids": [
"pat-0103",
"pat-0382",
"pat-0770"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 3320,
"org": "Deutsche Telekom AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d8b59e5e180c925f1f503baf933962de",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 42
},
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"evidence": {
"request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n",
"payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f866990c64438f32008aaeff1f4c89b7978221e6",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)",
"evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ISAPI\/Streaming\/channels\/102 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sd",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
554,
1935,
5000,
5001,
7070,
7447,
8554,
8557,
10554
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"flask-http",
"port:10554",
"port:7070",
"port:7447",
"port:8557",
"rtmp",
"rtsp",
"rtsp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|