Renseignement sur les menaces

Allemagne

93.212.232.71

FAI Deutsche Telekom AG Première vue 25/07/2026 05:14 UTC Dernière vue 25/07/2026 18:31 UTC Risque Moyen

Période analysée : 2026-04-29 → 2026-07-28

Activité suspecte · risque 47/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 47/100 Moyen

Première observation 25/07/2026 05:14 UTC

Dernière observation 25/07/2026 18:31 UTC

Événements (période) 392

MITRE ATT&CK principal T1046 388 occurrences

Activité suspecte · risque 47/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « rtsp_probe » (signaux protocolaires) · confiance 95%

Confiance 100 % — Score WAF 8 · Bonus corrélation +8

Comparaison ASN / FAI

ASN 3320 · 93.192.0.0/10 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 392 événements sur la période pour cette IP.

84.167.123.29 Injection SQL 28/07/2026 13:15 UTC
80.142.237.164 Injection SQL 28/07/2026 13:15 UTC
84.158.153.137 Cross-site scripting 28/07/2026 13:14 UTC
195.145.129.152 sip probe 28/07/2026 08:29 UTC
91.7.128.163 Injection SQL 28/07/2026 08:12 UTC
91.33.167.75 Injection SQL 28/07/2026 08:12 UTC
84.181.48.240 Cross-site scripting 28/07/2026 08:11 UTC
93.205.2.243 Injection SQL 28/07/2026 02:48 UTC

Événements (filtres)

392

Première observation

25/07/2026 05:14 UTC

Dernière observation

25/07/2026 18:31 UTC

Dernière activité (filtres)

25/07/2026 18:31 UTC

Événements 7j

392

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

UPNP TCP TCP 55 FLASK HTTP TCP 55 RTMP TCP 54 RTSP ALT TCP 4 RTSP TCP 4

UPNP TCP

FLASK HTTP

RTMP

RTSP ALT

RTSP

Géolocalisation

Origine réseau déclarée

Allemagne unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Deutsche Telekom AG 0 Port 554 rtsp_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

rtsp probe · via RTSP ALT:8554 · (sonde / probe)

Détails protocole

Aperçu payload

OPTIONS rtsp://62.3.50.33:8554/Streaming/Channels/101 RTSP/1.0 CSeq: 1 User-Agent: Lavf62.10.101

Port / service

8554 · RTSP ALT

Service émulé

RTSP-ALT

Raison confiance

Confiance 95 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0382 Upstream

Confiance

100% Corrélation +8

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

392 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

392 événement(s) — page 2/8

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
25/07/2026 05:15:11 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Scan de ports port scan syn · via UPNP TCP:5001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags net_tor_exit_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload DESCRIBE rtsp://62.3.50.33:5001/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: applica Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5001/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: applica Requête brute (extrait) DESCRIBE rtsp://62.3.50.33:5001/cam/realmonitor?channel=1&subtype=0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 140, "payload_entropy": 5.213266729031305, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 3320, "country": "DE", "dst_port": 5001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b8802baad5a7e519bd43629375cdee8e2d429c95", "event_fingerprint": "6c097e3287334ec7ee77aab782f9ffdd1351837a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0a2e7c36556d32d9dc84348de758b4a7", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cf2491d50c03b8755d53f1f41fedcf4da900ee77", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "tor_exit_probe" ] }
25/07/2026 05:15:11 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Scan de ports port scan syn · via UPNP TCP:5001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags net_tor_exit_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload DESCRIBE rtsp://62.3.50.33:5001/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: applica Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5001/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: applica Requête brute (extrait) DESCRIBE rtsp://62.3.50.33:5001/cam/realmonitor?channel=1&subtype=1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 140, "payload_entropy": 5.213266729031305, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 3320, "country": "DE", "dst_port": 5001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b8802baad5a7e519bd43629375cdee8e2d429c95", "event_fingerprint": "6c097e3287334ec7ee77aab782f9ffdd1351837a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1b0ceb8f7f442805fcfff55ea58f0d41", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1422bc6a258c0bfc56d661230ddccbb12c13936", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/cam\/realmonitor?channel=1&subtype=1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: applica", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_tor_exit_probe", "tor_exit_probe" ] }
25/07/2026 05:15:11 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Scan de ports port scan syn · via UPNP TCP:5001 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload DESCRIBE rtsp://62.3.50.33:5001/live RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5001/live RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 109, "payload_entropy": 5.0611983537629, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 3320, "country": "DE", "dst_port": 5001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8ff9356363056e09a7ce0be0e1ecc437", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a56204e3fda614affa5721360d137e8c26cfcb3a", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }
25/07/2026 05:15:11 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Scan de ports port scan syn · via UPNP TCP:5001 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload DESCRIBE rtsp://62.3.50.33:5001/live.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5001/live.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 113, "payload_entropy": 5.0607421629223355, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 3320, "country": "DE", "dst_port": 5001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a67d243f4a42ce92a941b7341a544488", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1814962064f5279662ec322e508dca027b74501a", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/live.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }
25/07/2026 05:15:11 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Scan de ports port scan syn · via UPNP TCP:5001 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload DESCRIBE rtsp://62.3.50.33:5001/ch0_0.264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5001/ch0_0.264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 114, "payload_entropy": 5.112403130290393, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 3320, "country": "DE", "dst_port": 5001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a921b1d829ccfb4adb418360b04093d0", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ca8f23c2eafcf1e16cd4f57f7232cb2222720d01", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/ch0_0.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/onvif2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/onvif2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 111, "payload_entropy": 5.095084967635254, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fe86ae207be90de8ca052c39fd8f0f7b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6d0690c5148c9bf6fd8fc79735cb6c76b6383867", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/main RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/main RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 109, "payload_entropy": 5.044598616013758, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05ee14e09ad89299656d297c289ca23a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c3a972ee1f8c7ea3aa4396a60df965f0ca45e64", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ], "behavior_alert_count": 2, "behavior_priority": 72 }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/sub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/sub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 108, "payload_entropy": 5.0742734810654575, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d42d199f0edd7d0e6bd9713629925d1a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "caf74d72c043da7691e073709065c57bd1341805", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/primary RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/primary RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 112, "payload_entropy": 5.06613983917446, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "61f7bf96cf9a01b4c0ed210eb1337e1e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7ac8ac4acc924ff6a72c19e39551296e6e980bca", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/primary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/secondary RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/secondary RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 114, "payload_entropy": 5.051171112822443, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f4f760a1b97de33bfe91d0ed3bd577b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28f140869bf09f60cea7b79fad4723313ede8b6e", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/secondary RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/stream RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/stream RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 111, "payload_entropy": 5.033097719696188, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "92a1f60ebc056c51f9a245ef54f2a8c4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9f35c227a09e8e46fb556ebf023268afb5535c42", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/stream0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/stream0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 112, "payload_entropy": 5.02694020055336, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29deee41f08b44d9d1062e068227b3dd", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "508f6a6123ffb8103a5b355fcedac12ec1cad553", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h264.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h264.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 113, "payload_entropy": 5.09437286256641, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "19162d5f062d7b3379c7181defecf7f2", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1510dd5ca7f616145859258a579c07ab067066f6", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h265.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h265.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 113, "payload_entropy": 5.069993327149034, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "983d603153781269abfa092dca1ef80d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9f88c47894e9dfec3f2e4304172b6709188520bd", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:10 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Scan de ports port scan syn · via UPNP TCP:5001 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/101 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5001/Streaming/Channels/101 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 127, "payload_entropy": 5.051908760424749, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 3320, "country": "DE", "dst_port": 5001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ba07e742993ee75e249cd1567388bf9", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8ca782e32f5c961b2246d47d6639cffc00f456fe", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via UPNP TCP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "port scan syn \u00b7 via UPNP TCP:5001 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5001\/Streaming\/Channels\/101 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 0.61, "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/1/h264minor RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/1/h264minor RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 116, "payload_entropy": 5.129309751272062, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "51caa28bb08e18a1537163d5e525dbab", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ccccfe58cb5ec9c7f605d86991fb02425dcec79e", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/0/h264major RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/0/h264major RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 116, "payload_entropy": 5.1463284448154845, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "21bc24a4cc8296fdfd517562dfa785b8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "300e236583b1291ae858c7d0beed2773ff82e891", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/0/h264minor RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/0/h264minor RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 116, "payload_entropy": 5.119436932067521, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "78115196e2cc3de1182d1105f072a128", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d183375c9acc30731b7bf632cf1a57c558f38e2b", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/0\/h264minor RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/ch0_0.h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/ch0_0.h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 115, "payload_entropy": 5.110513296947954, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "65365478c94df42ca8f9efdbcec90745", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "43fa1b99562f02cb65bde6e8cdb346e11278b3eb", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_0.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/ch0_1.h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/ch0_1.h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 115, "payload_entropy": 5.122572618234153, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e0424292801dd0246b76400c841cd787", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "679a59544d5335fdd59592f3b22f78f20b9c1510", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/av0_0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/av0_0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 110, "payload_entropy": 5.058194638446917, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "804ccea1d7dadd0138c067d1ed76ae83", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "159ff3808c4cf42cb598991bf6478cb46d928eb6", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/av0_1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/av0_1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 110, "payload_entropy": 5.0708021107006696, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "918ac3ce3243949609999d605a532233", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1caaeeddc259fb2931eaceb80347692628373e52", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/av0_1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/live0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/live0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 110, "payload_entropy": 5.0466655467729105, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad30b415b9aa43ff89b97aa85cd9a52b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5a11f5ece530a05cef6c18b4444992edd2685cb", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/live1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/live1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 110, "payload_entropy": 5.057076883388607, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4303d16195909900a99ea1effbce3ef0", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "27d0c160cd180ae7d92483104f622ab01dc41ff9", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/onvif-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/onvif-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 126, "payload_entropy": 5.1046466992740465, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a300c8362acb88bb9efc51f3ca440200", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d3baf28cb28502d304cdee741700fe80a2352ef0", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:09 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/onvif1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/onvif1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 111, "payload_entropy": 5.0882841793274745, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "03e6a8723c15c528eca9267897f5bd17", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10aaecad36a3a0cec71e1d1c014e0999db58367a", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/onvif1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/videoMain RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/videoMain RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 114, "payload_entropy": 5.08713484501639, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c7e580a36a8c3be5262494a274c80e07", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d205daa82f55298057d2943ee7b6b08c1b0289ac", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoMain RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/videoSub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/videoSub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 113, "payload_entropy": 5.113839508055079, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d87fd5718041694eede5cc9b07fe451d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b2e052649ac060de7b7a4214064a1a94f1da0be", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/videoSub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 109, "payload_entropy": 5.096063207522353, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "472ecfc1820a6f0c7f29e3ae6aa15c4d", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a12a7734699d93f3f7855836c9c468f9570eb91e", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h265 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h265 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 109, "payload_entropy": 5.070789010254798, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0fdb1c1ae5c5627e63d4a029b01d247", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "31fd223addcb5d99be1878da2b956a23ad53b40f", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h265 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/stream1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/stream1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 112, "payload_entropy": 5.037165620443777, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "89c15aee894089edbfc6cb24530e60e0", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "168eba8501f4dc2f385eef4cd49409f4cdaa88d5", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/stream2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/stream2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 112, "payload_entropy": 5.0439056874273795, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2bcc0ff674df212afbe34e0654b6a1e", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f124591d652edb711d806b16d70e50b8303bfa5a", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/stream2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/live/ch0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/live/ch0 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 113, "payload_entropy": 5.065080437220328, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "99eaa8d0a4a1a232a1472afb5ce8609c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d9c04c3ebea6fcbe68f3c55927992a9ae3a197c", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch0 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/live/ch1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/live/ch1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 113, "payload_entropy": 5.075215366669236, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6abbceeafb450e0cf8dbda67a4823ee8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94f3e3b1af29c693f8404c2acc968d13ca54bcb5", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live\/ch1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/video.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/video.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 114, "payload_entropy": 5.057223357874135, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad1d22472e4a27f0baf61a7c536c5a0c", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2211bde28b7680107b0985efb04dc5a9386ee12", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/video.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/live_h264.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/live_h264.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 118, "payload_entropy": 5.156616682285859, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e710c37165a9cbe0c3d41c64b03202f3", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "14ef69f49ac6ffb808ed92645b074a625dbf8bf5", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/live_h264.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:08 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/1/h264major RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/1/h264major RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 116, "payload_entropy": 5.156201264020024, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b20cb85ccff66b08dda834b7f1136d31", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f8b9f8516e6c3f946fde9d73edbef9e79e20d120", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/1\/h264major RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/ch0_1.264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/ch0_1.264 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 114, "payload_entropy": 5.112403130290393, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7c2f8998c6c0b9eff2dcd5755cd4ac8f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d2f369614a82a482ad63b45b2373c6acca9f7ebc", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/ch0_1.264 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/axis-media/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 125, "payload_entropy": 5.063952542854603, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c02b418f0863a2b2283f7c11a404ae84", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "488452b2da4e54c45a6e0b73e30dbe04cf870216", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/axis-media\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/mpeg4/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/mpeg4/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 120, "payload_entropy": 5.0717306562617805, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3f58cb981bf8bb84ee89bc3155e0f6de", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5f69ef1112e36e98ed5307a3a98d87e08633643a", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/mpeg4\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h264/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h264/media.amp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 119, "payload_entropy": 5.120188466507166, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05f96688bbf3c6cfd0f9e5758090dd29", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e92e8105a4e1417c4d954464b123d7d6cb332a47", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264\/media.amp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h264Preview_01_main RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h264Preview_01_main RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 124, "payload_entropy": 5.197641304217179, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cd3d2edbd0e33501e6b36c628ddbd6ba", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "037596c4f7e368df60ba8816fc79f43e1cc78fc7", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_main RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/h264Preview_01_sub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/h264Preview_01_sub RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 123, "payload_entropy": 5.227408263121605, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7b8e6c69bc5e0e745c7847466ac8cb8a", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc1319f5da1bcb1c4b8d073e4180028c40025480", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/h264Preview_01_sub RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/bcs/channel0_main.bcs RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/bcs/channel0_main.bcs RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 126, "payload_entropy": 5.093640175877914, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6b67dac8b357eadaaaa1cf96a7d5ac9f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "02df7603b6b47c03eb44d81e8f31e41341d94a4e", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_main.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/bcs/channel0_sub.bcs RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/bcs/channel0_sub.bcs RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 125, "payload_entropy": 5.097885142216093, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7878714f790bb4ad49f14f2282f3d5c4", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7b8e14881d342f4b55a78a5da1b986a44b8e11b5", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/bcs\/channel0_sub.bcs RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/unicast/c1/s1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/unicast/c1/s1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 118, "payload_entropy": 5.0191951282924405, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8dbd79e172cbf5356340e72964fe7338", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ba8e9abfd9ca27787cf472b7568df7c5a2127e95", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/unicast/c1/s2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/unicast/c1/s2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 118, "payload_entropy": 5.029746929121564, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4135dfda37dccae789bf6146c663c81b", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9729b4bf14df4c3607f0fff1242c6a2f6362d712", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/unicast\/c1\/s2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/media/video1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/media/video1 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 117, "payload_entropy": 5.0843983281922185, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4a7fd8828201c06a13444206ae2da103", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0eb980c1f636469e1cad3b62bfb25095a1d841d6", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video1 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:07 UTC	TCP	5000 · FLASK HTTP	flask-http	Scan de ports port scan syn · via FLASK HTTP:5000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur FLASK-HTTP WAF — Recommandation Surveiller Tags flask_http_emulated net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5000 Chemin / cible — Service FLASK HTTP Payload DESCRIBE rtsp://62.3.50.33:5000/media/video2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:5000/media/video2 RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c", "emulator_response_len": 158, "bytes_in": 117, "payload_entropy": 5.090850358125239, "port_category": "registered", "org": "Deutsche Telekom AG", "service": "flask-http", "app_proto": "flask-http", "asn": 3320, "country": "DE", "dst_port": 5000, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3eec9fba1e23cfd0abfb45632b14240dd83be731", "event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "service_name": "flask-http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "00c10d5be9ebb281220c85c6146e4c50", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 5000, "service": "flask-http", "service_name": "flask-http", "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "06b2ef4ebf9d1f4996c0a5ae5d33b7497a8379b9", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FLASK HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "flask-http", "service_label_fr": "FLASK HTTP", "dst_port": 5000, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-flask-http", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 5000, "service": "flask-http", "service_label_fr": "FLASK HTTP" }, "attack_vector": "port scan syn \u00b7 via FLASK HTTP:5000 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:5000\/media\/video2 RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "5000 \u00b7 FLASK HTTP", "emulator_service": "flask-http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "flask_http", "service_banner": "honeypot-flask-http", "service_os": "linux", "dst_port": "5000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "flask_http_emulated", "net_web_probe" ] }
25/07/2026 05:15:06 UTC	TCP	7070	—	Scan de ports port scan syn · port 7070 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7070 Chemin / cible — Payload DESCRIBE rtsp://62.3.50.33:7070/h265.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass RTSP protocol RTSP DESCRIBE User-Agent — Règles WAF — Payload (extrait) DESCRIBE rtsp://62.3.50.33:7070/h265.sdp RTSP/1.0 CSeq: 1 User-Agent: RTSP-Scanner Accept: application/sdp Meta JSON brut { "bytes_in": 113, "payload_entropy": 5.108617468534877, "port_category": "registered", "org": "Deutsche Telekom AG", "service": null, "app_proto": null, "asn": 3320, "country": "DE", "dst_port": 7070, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 15 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "85e268abe8161836f34dd076a5744ff3d140ea6d", "event_fingerprint": "06ab2ebf1471cd00f31ad459b21e0ed985cb3512", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103", "pat-0382", "pat-0770" ], "matched_pattern_names": [ "LFI Double-dot bypass", "RTSP protocol", "RTSP DESCRIBE" ], "pattern_ids": [ "pat-0103", "pat-0382", "pat-0770" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 3320, "org": "Deutsche Telekom AG", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "44de57a780c8810dd3ac460b2d0a16bb", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 7070, "risk_score": 42 }, "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "evidence": { "request_sample": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "744bc4ccd59e9e381e5c11450dac40dc761022c9", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 7070 }, "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "attack_vector": "port scan syn \u00b7 port 7070 \u00b7 (reconnaissance)", "target_port_label": "7070", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (9 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 15, "risk_score": 42, "correlation_boost": 14 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7070, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +14", "protocol_details": { "payload_preview": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "port": 7070 }, "attack_vector": "port scan syn \u00b7 port 7070 \u00b7 (reconnaissance)", "evidence_snippet": "DESCRIBE rtsp:\/\/62.3.50.33:7070\/h265.sdp RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSP-Scanner\r\nAccept: application\/sdp", "target_port_label": "7070", "emulator_service": null, "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7070" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 554, 1935, 5000, 5001, 7070, 7447, 8554, 8557, 10554 ], "multi_protocol_correlation": true, "multi_protocol_count": 9, "multi_protocol_sample": [ "flask-http", "port:10554", "port:7070", "port:7447", "port:8557", "rtmp", "rtsp", "rtsp-alt" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "multi_protocol_correlation" ], "correlation_confidence_boost": 14, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }

93.212.232.71

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence