|
|
TCP |
7000 · CASSANDRA JMX
|
cassandra-jmx
|
Sonde Cassandra
cassandra probe · via CASSANDRA JMX:7000 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CASSANDRA-JMX
WAF
—
Recommandation
Surveiller
Tags
cassandra_emulated
net_cassandra_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7000
Chemin / cible
—
Service
CASSANDRA JMX
Payload
Њ%�x�4yG{����m�@a�DI�c���Htd�c].~�4��O%��L�'�p�$��X��*�|�����I�V�i�S�2,d�w�N�/�-@�v2���B�< ;��ӣ�/ �Xc���D��~ҢȊp
Pourquoi cette classification : Type « cassandra_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
Њ%�x�4yG{����m�@a�DI�c���Htd�c].~�4��O%��L�'�p�$��X��*�|�����I�V�i�S�2,d�w�N�/�-@�v2���B�< ;��ӣ�/ �Xc���D��~ҢȊp
Requête brute (extrait)
Њ%�x�4yG{����m�@a�DI�c���Htd�c].~�4��O%��L�'�p�$��X��*�|�����I�V�i�S�2,d�w�N�/�-@�v2���B�< ;��ӣ�/ �Xc���D��~ҢȊp����hmW��7i�g�f�2-�q��h� )�Pc ��� j� �-���Qؗke-���-;\@ep�Ha)��\���=yHQ.�v�I�[�� "1{\�z 爓k�*�O/���ˣ�yf��q��/���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4f4b0d0a",
"emulator_response_len": 4,
"bytes_in": 256,
"payload_entropy": 7.130049255790211,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "cassandra-jmx",
"app_proto": "cassandra-jmx",
"asn": 219502,
"country": "NL",
"dst_port": 7000,
"risk_waf": 8,
"risk_classification": 55,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0f2b3f688e52b847eec81bfc3a7ca929d263c647",
"event_fingerprint": "0515a90696fafcab67973d1c4c56caf19b56703e",
"classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "cassandra-jmx",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "27bdf90bd890e5e88a4bf2c15ecb2e39",
"path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
},
"target_context": {
"dst_port": 7000,
"service": "cassandra-jmx",
"service_name": "cassandra-jmx",
"risk_score": 34
},
"payload_preview": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"request_sample": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\ufffd\ufffd\ufffd\ufffdhmW\ufffd\ufffd7\u0001i\ufffdg\u0019\ufffdf\ufffd\u00012-\u0019\ufffdq\ufffd\ufffd\u0004h\ufffd\u000b)\ufffdPc\u001e\ufffd\ufffd\ufffd\u001e\u000bj\ufffd\r\ufffd\u0012-\ufffd\ufffd\ufffdQ\u0617ke-\ufffd\ufffd\u0012\ufffd-;\\@ep\ufffdHa)\ufffd\ufffd\\\u0012\ufffd\ufffd\ufffd=yHQ.\ufffdv\ufffdI\ufffd[\ufffd\ufffd\t\"1\u000e{\u0006\u0011\\\ufffdz\u001d\u7213k\ufffd*\ufffdO\/\ufffd\ufffd\ufffd\u02e3\u0018\ufffdyf\ufffd\ufffdq\ufffd\ufffd\/\ufffd\ufffd\ufffd",
"payload_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"evidence": {
"request_sample": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\ufffd\ufffd\ufffd\ufffdhmW\ufffd\ufffd7\u0001i\ufffdg\u0019\ufffdf\ufffd\u00012-\u0019\ufffdq\ufffd\ufffd\u0004h\ufffd\u000b)\ufffdPc\u001e\ufffd\ufffd\ufffd\u001e\u000bj\ufffd\r\ufffd\u0012-\ufffd\ufffd\ufffdQ\u0617ke-\ufffd\ufffd\u0012\ufffd-;\\@ep\ufffdHa)\ufffd\ufffd\\\u0012\ufffd\ufffd\ufffd=yHQ.\ufffdv\ufffdI\ufffd[\ufffd\ufffd\t\"1\u000e{\u0006\u0011\\\ufffdz\u001d\u7213k\ufffd*\ufffdO\/\ufffd\ufffd\ufffd\u02e3\u0018\ufffdyf\ufffd\ufffdq\ufffd\ufffd\/\ufffd\ufffd\ufffd",
"payload_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f0903d372dd20436ad24d23f2b67f0a1b5e34eca",
"protocol_details": {
"payload_preview": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"port": 7000,
"service": "cassandra-jmx",
"service_label_fr": "CASSANDRA JMX"
},
"evidence_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\ufffd\ufffdm\ufffd@a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffdL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffdV\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\ufffdB\ufffd<;\ufffd\ufffd\u04e3\ufffd\/\ufffdXc\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
"target_port_label": "7000 \u00b7 CASSANDRA JMX",
"emulator_service": "cassandra-jmx",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "cassandra-jmx",
"service_label_fr": "CASSANDRA JMX",
"dst_port": 7000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cassandra-jmx",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"port": 7000,
"service": "cassandra-jmx",
"service_label_fr": "CASSANDRA JMX"
},
"attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\ufffd\ufffdm\ufffd@a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffdL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffdV\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\ufffdB\ufffd<;\ufffd\ufffd\u04e3\ufffd\/\ufffdXc\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
"target_port_label": "7000 \u00b7 CASSANDRA JMX",
"emulator_service": "cassandra-jmx",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cassandra_jmx",
"service_banner": "honeypot-cassandra-jmx",
"service_os": "linux",
"dst_port": "7000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cassandra_emulated",
"net_cassandra_probe"
]
}
|
|
|
TCP |
7000 · CASSANDRA JMX
|
cassandra-jmx
|
Sonde Cassandra
cassandra probe · via CASSANDRA JMX:7000 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CASSANDRA-JMX
WAF
—
Recommandation
Surveiller
Tags
cassandra_emulated
net_cassandra_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7000
Chemin / cible
—
Pourquoi cette classification : Type « cassandra_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4f4b0d0a",
"emulator_response_len": 4,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "cassandra-jmx",
"app_proto": "cassandra-jmx",
"asn": 219502,
"country": "NL",
"dst_port": 7000,
"risk_waf": 8,
"risk_classification": 55,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0f2b3f688e52b847eec81bfc3a7ca929d263c647",
"event_fingerprint": "0515a90696fafcab67973d1c4c56caf19b56703e",
"classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "cassandra-jmx",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
},
"target_context": {
"dst_port": 7000,
"service": "cassandra-jmx",
"service_name": "cassandra-jmx",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a8e77f85013084f1d7f610baac29bf346ce744e",
"protocol_details": {
"port": 7000,
"service": "cassandra-jmx",
"service_label_fr": "CASSANDRA JMX"
},
"attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
"target_port_label": "7000 \u00b7 CASSANDRA JMX",
"emulator_service": "cassandra-jmx",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "cassandra-jmx",
"service_label_fr": "CASSANDRA JMX",
"dst_port": 7000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cassandra-jmx",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 7000,
"service": "cassandra-jmx",
"service_label_fr": "CASSANDRA JMX"
},
"attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7000 \u00b7 CASSANDRA JMX",
"emulator_service": "cassandra-jmx",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cassandra_jmx",
"service_banner": "honeypot-cassandra-jmx",
"service_os": "linux",
"dst_port": "7000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cassandra_emulated",
"net_cassandra_probe"
]
}
|
|
|
TCP |
7777 · GAME UNREAL
|
game-unreal
|
Sonde jeu Unreal
game-unreal · via GAME UNREAL:7777 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
GAME-UNREAL
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7777
Chemin / cible
—
Pourquoi cette classification : Type « game-unreal » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a",
"emulator_response_len": 42,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "game-unreal",
"app_proto": "game-unreal",
"asn": 219502,
"country": "NL",
"dst_port": 7777,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1b3d300e4640d68205ab45deb6d5b1ebf8a12b3d",
"event_fingerprint": "a35789f75452d6a73be983d5f266e3a77d710b7e",
"classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "game-unreal",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "10384eda5161b41f764c9b11f5a8ba8f"
},
"target_context": {
"dst_port": 7777,
"service": "game-unreal",
"service_name": "game-unreal",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9527121fc6aebc6f3291b99470b57d59466939ee",
"protocol_details": {
"port": 7777,
"service": "game-unreal",
"service_label_fr": "GAME UNREAL"
},
"attack_vector": "game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)",
"target_port_label": "7777 \u00b7 GAME UNREAL",
"emulator_service": "game-unreal",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "game-unreal",
"service_label_fr": "GAME UNREAL",
"dst_port": 7777,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-game-unreal",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 7777,
"service": "game-unreal",
"service_label_fr": "GAME UNREAL"
},
"attack_vector": "game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7777 \u00b7 GAME UNREAL",
"emulator_service": "game-unreal",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "game_unreal",
"service_banner": "honeypot-game-unreal",
"service_os": "linux",
"dst_port": "7777"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Faible
|
Faible · 4
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
256
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 4
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 4,
"payload_entropy": 2,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 219502,
"country": "NL",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 4,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2942165fd692cfaa6cdf826c207b19bf65cf2da8",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 4
},
"service_name": "irc-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 4
},
"payload_preview": "256\u0000",
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"evidence": {
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b25cb54ba2d4551fda11f168aeab0b243a2aeae5",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "256",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 4
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 4,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "256",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
� Y�w���}��:�QFBFW����u��ۺp�V>��@>� v��Ayr�,����:�{�Ɉ׆(�hoN5� :!-3!�� x��1VVb��~Dqڢ��w��o�}����Y�-o��g��9v �8
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� Y�w���}��:�QFBFW����u��ۺp�V>��@>� v��Ayr�,����:�{�Ɉ׆(�hoN5� :!-3!�� x��1VVb��~Dqڢ��w��o�}����Y�-o��g��9v �8
Requête brute (extrait)
� Y�w���}��:�QFBFW����u��ۺp�V>��@>� v��Ayr�,����:�{�Ɉ׆(�hoN5� :!-3!�� x��1VVb��~Dqڢ��w��o�}����Y�-o��g��9v �8��B��@9ӊfe���)�!��ԅlw�k`�!/-� 1��.�u���^�T�y��Ba�%JŠ��pd ;B��qM�u N5��Wʆ���!�� R�ADH0�b�w$*| B,m�:)]qD3����1O
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"bytes_in": 256,
"payload_entropy": 7.101357935602921,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 219502,
"country": "NL",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2942165fd692cfaa6cdf826c207b19bf65cf2da8",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "irc-alt",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b00ed97e39eb0f1480f9e30df81c1d77",
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 0
},
"payload_preview": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
"request_sample": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8\ufffd\ufffdB\ufffd\ufffd\u0003@\u00159\u04cafe\ufffd\ufffd\ufffd)\ufffd!\u000f\ufffd\ufffd\u0003\u0505lw\ufffdk`\ufffd!\/-\ufffd\t1\ufffd\ufffd.\ufffdu\u0012\ufffd\ufffd\ufffd^\ufffdT\ufffdy\ufffd\ufffdBa\ufffd%J\u0160\ufffd\ufffdpd\r;\u000eB\ufffd\ufffdq\u001aM\ufffdu\u001fN\u00045\u0006\ufffd\ufffdW\u0286\ufffd\ufffd\ufffd!\ufffd\ufffd\fR\ufffdADH0\ufffdb\ufffdw$*| B,\u0003m\ufffd\u0006:)\u0011]qD3\ufffd\ufffd\ufffd\ufffd1O",
"payload_snippet": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
"evidence": {
"request_sample": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8\ufffd\ufffdB\ufffd\ufffd\u0003@\u00159\u04cafe\ufffd\ufffd\ufffd)\ufffd!\u000f\ufffd\ufffd\u0003\u0505lw\ufffdk`\ufffd!\/-\ufffd\t1\ufffd\ufffd.\ufffdu\u0012\ufffd\ufffd\ufffd^\ufffdT\ufffdy\ufffd\ufffdBa\ufffd%J\u0160\ufffd\ufffdpd\r;\u000eB\ufffd\ufffdq\u001aM\ufffdu\u001fN\u00045\u0006\ufffd\ufffdW\u0286\ufffd\ufffd\ufffd!\ufffd\ufffd\fR\ufffdADH0\ufffdb\ufffdw$*| B,\u0003m\ufffd\u0006:)\u0011]qD3\ufffd\ufffd\ufffd\ufffd1O",
"payload_snippet": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61b54a753ef1b024dd5e2287c7446cb5cd79604c",
"protocol_details": {
"payload_preview": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"evidence_snippet": "\ufffdY\ufffdw\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFBFW\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\ufffdv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\ufffd:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd:!-3!\ufffd\ufffdx\ufffd\ufffd1VVb\ufffd\ufffd~Dq\u06a2\ufffd\ufffdw\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\ufffd8",
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdY\ufffdw\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFBFW\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\ufffdv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\ufffd:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd:!-3!\ufffd\ufffdx\ufffd\ufffd1VVb\ufffd\ufffd~Dq\u06a2\ufffd\ufffdw\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\ufffd8",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Sonde IRC
irc-alt · via IRC ALT:6666 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Pourquoi cette classification : Type « irc-alt » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
"emulator_response_len": 50,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "irc-alt",
"app_proto": "irc-alt",
"asn": 219502,
"country": "NL",
"dst_port": 6666,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2942165fd692cfaa6cdf826c207b19bf65cf2da8",
"event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "irc-alt",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
},
"target_context": {
"dst_port": 6666,
"service": "irc-alt",
"service_name": "irc-alt",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1270c30260d06cd6f58ed12f92a1019f6d927c62",
"protocol_details": {
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "irc-alt",
"service_label_fr": "IRC ALT",
"dst_port": 6666,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-irc-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 6666,
"service": "irc-alt",
"service_label_fr": "IRC ALT"
},
"attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "6666 \u00b7 IRC ALT",
"emulator_service": "irc-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "irc_alt",
"service_banner": "honeypot-irc-alt",
"service_os": "linux",
"dst_port": "6666"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6000
|
—
|
Sonde port 6000
Sonde port · port 6000 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6000
Chemin / cible
—
Payload
̉���RC �QI����&4#��|��ޖ��$*�'�e � a(�´�(��@�9�C�{ �� ����<X�ņ%�ֺ:��%6ox���Z�(��n>ey����5��b����a_��y��(?%�w8�xvrM��
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
̉���RC �QI����&4#��|��ޖ��$*�'�e
�
a(�´�(��@�9�C�{ �� ����<X�ņ%�ֺ:��%6ox���Z�(��n>ey����5��b����a_��y��(?%�w8�xvrM��
Requête brute (extrait)
̉���RC �QI����&4#��|��ޖ��$*�'�e � a(�´�(��@�9�C�{ �� ����<X�ņ%�ֺ:��%6ox���Z�(��n>ey����5��b����a_��y��(?%�w8�xvrM�۸*��M�I��%9o?�t��*3��uQ�u�x�Ӯ�Y0h� +?�� ��*SI�T������N�_H@Y�P���ȡb�x����z�<�a�Xj�˥:FFѫ��J=S&���t��p^��;e5^���qL
Meta JSON brut
{
"bytes_in": 256,
"payload_entropy": 7.163757031114784,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": null,
"app_proto": null,
"asn": 219502,
"country": "NL",
"dst_port": 6000,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324",
"event_fingerprint": "ee4840953fa1cc900d65a98f0af258a8aa6cd646",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dd5f3f91031d1205079ea8ab20123ae7",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 6000,
"risk_score": 44
},
"payload_preview": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"request_sample": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\u06f8*\ufffd\ufffd\u0018M\ufffdI\ufffd\ufffd%9o?\ufffdt\ufffd\ufffd*3\ufffd\ufffd\u0014uQ\ufffdu\ufffdx\ufffd\u04ee\ufffdY0h\ufffd\n+?\ufffd\ufffd\u000f\f\ufffd\ufffd*SI\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd_H@Y\ufffdP\ufffd\ufffd\ufffd\u0221b\ufffdx\u0016\u001b\ufffd\ufffd\u0015\ufffd\ufffdz\ufffd<\ufffda\ufffdXj\ufffd\u02e5\u0080:FF\u046b\ufffd\u0011\ufffdJ=S&\ufffd\ufffd\ufffdt\ufffd\ufffdp^\ufffd\ufffd;e5^\ufffd\ufffd\ufffdqL\u0014",
"payload_snippet": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"evidence": {
"request_sample": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\u06f8*\ufffd\ufffd\u0018M\ufffdI\ufffd\ufffd%9o?\ufffdt\ufffd\ufffd*3\ufffd\ufffd\u0014uQ\ufffdu\ufffdx\ufffd\u04ee\ufffdY0h\ufffd\n+?\ufffd\ufffd\u000f\f\ufffd\ufffd*SI\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd_H@Y\ufffdP\ufffd\ufffd\ufffd\u0221b\ufffdx\u0016\u001b\ufffd\ufffd\u0015\ufffd\ufffdz\ufffd<\ufffda\ufffdXj\ufffd\u02e5\u0080:FF\u046b\ufffd\u0011\ufffdJ=S&\ufffd\ufffd\ufffdt\ufffd\ufffdp^\ufffd\ufffd;e5^\ufffd\ufffd\ufffdqL\u0014",
"payload_snippet": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd9ec67ccea78f29ca1844c5ac98b50aef05ff00",
"protocol_details": {
"payload_preview": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"port": 6000
},
"evidence_snippet": "\u0309\ufffd\ufffd\ufffdRC\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u05ba:\ufffd\ufffd%6ox\ufffd\ufffd\ufffdZ\ufffd(\ufffd\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
"target_port_label": "6000",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 6000,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"port": 6000
},
"attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\u0309\ufffd\ufffd\ufffdRC\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u05ba:\ufffd\ufffd%6ox\ufffd\ufffd\ufffdZ\ufffd(\ufffd\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
"target_port_label": "6000",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "6000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
6000
|
—
|
Sonde port 6000
Sonde port · port 6000 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6000
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": null,
"app_proto": null,
"asn": 219502,
"country": "NL",
"dst_port": 6000,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "5c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324",
"event_fingerprint": "ee4840953fa1cc900d65a98f0af258a8aa6cd646",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 6000,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2936c8ba6703a2374942872f8741d9affb522b2",
"protocol_details": {
"port": 6000
},
"attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
"target_port_label": "6000",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 6000,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 6000
},
"attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "6000",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "6000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7005 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7005 · (sonde / probe)
|
Faible
|
Faible · 8
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7005
Chemin / cible
—
Service
WEBLOGIC CLUSTER
Payload
256
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4,
"payload_entropy": 2,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7005,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293",
"event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "weblogic-cluster",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7005,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 8
},
"payload_preview": "256\u0000",
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"evidence": {
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bf7e8b577b9bf76189d62058f71a00b4066abd5",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 7005,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"evidence_snippet": "256",
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
"target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7005,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 7005,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "256",
"target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7005 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7005 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7005
Chemin / cible
—
Service
WEBLOGIC CLUSTER
Payload
&�.�K���ׇ�B1R C@�������"�KN���S �A������:�de�]+�)�~�����d{w��?TEp��dm�)/q16 ����#b�ڑ Q���=�� -��1r1���.hNk��L
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
&�.�K���ׇ�B1R C@�������"�KN���S
�A������:�de�]+�)�~�����d{w��?TEp��dm�)/q16 ����#b�ڑ
Q���=�� -��1r1���.hNk��L
Requête brute (extrait)
&�.�K���ׇ�B1R C@�������"�KN���S �A������:�de�]+�)�~�����d{w��?TEp��dm�)/q16 ����#b�ڑ Q���=�� -��1r1���.hNk��Lx M� �ц�RR��#�v�� �(���]*,��tp��b D��ϖ > +*K�P�؊p��؆H��0����^��൧��[� ��Y��iG�����|��"0��d� ��ѕ�]�l+��� �F r�hm
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 256,
"payload_entropy": 7.162723193198806,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7005,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293",
"event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "weblogic-cluster",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "206191dcd10d6194d2c7935d0c65e23f",
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7005,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 0
},
"payload_preview": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"request_sample": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u000ex\fM\ufffd\f\ufffd\u0446\ufffdR\b\u0001R\ufffd\ufffd#\ufffd\u0011v\ufffd\ufffd\n\ufffd(\ufffd\ufffd\ufffd]*,\ufffd\ufffdtp\ufffd\ufffdb\u001fD\ufffd\ufffd\u03d6\u001e>\r+*K\ufffdP\ufffd\u060ap\ufffd\ufffd\u0606H\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0d67\ufffd\ufffd[\ufffd\u001e\ufffd\b\ufffdY\ufffd\ufffdiG\ufffd\ufffd\ufffd\ufffd\ufffd|\u0011\ufffd\ufffd\"0\ufffd\ufffdd\u0014\ufffd\u001f\ufffd\ufffd\u0455\ufffd]\u0014\ufffdl+\ufffd\ufffd\ufffd\u0015\u001d\ufffdF\u000br\ufffdhm",
"payload_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"evidence": {
"request_sample": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u000ex\fM\ufffd\f\ufffd\u0446\ufffdR\b\u0001R\ufffd\ufffd#\ufffd\u0011v\ufffd\ufffd\n\ufffd(\ufffd\ufffd\ufffd]*,\ufffd\ufffdtp\ufffd\ufffdb\u001fD\ufffd\ufffd\u03d6\u001e>\r+*K\ufffdP\ufffd\u060ap\ufffd\ufffd\u0606H\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0d67\ufffd\ufffd[\ufffd\u001e\ufffd\b\ufffdY\ufffd\ufffdiG\ufffd\ufffd\ufffd\ufffd\ufffd|\u0011\ufffd\ufffd\"0\ufffd\ufffdd\u0014\ufffd\u001f\ufffd\ufffd\u0455\ufffd]\u0014\ufffdl+\ufffd\ufffd\ufffd\u0015\u001d\ufffdF\u000br\ufffdhm",
"payload_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5baad7e73c0a69573f4cc0a27679bae674eec7e",
"protocol_details": {
"payload_preview": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"port": 7005,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"evidence_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\ufffdB1RC@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\ufffd\ufffd\ufffdS\r\t\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd]+\ufffd)\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdd{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\ufffd\ufffd\ufffd#b\ufffd\u0691\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
"target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7005,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"port": 7005,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\ufffdB1RC@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\ufffd\ufffd\ufffdS\r\t\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd]+\ufffd)\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdd{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\ufffd\ufffd\ufffd#b\ufffd\u0691\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
"target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7005 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7005 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7005
Chemin / cible
—
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7005,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293",
"event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "weblogic-cluster",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7005,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2d7647940e0baf0c1a198c1bf73ea35e6e46630",
"protocol_details": {
"port": 7005,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
"target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7005,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 7005,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7007 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7007 · (sonde / probe)
|
Faible
|
Faible · 4
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7007
Chemin / cible
—
Service
WEBLOGIC CLUSTER
Payload
256
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 4
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4,
"payload_entropy": 2,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7007,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 4,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "738e0f1b893df8792a9cf1e422d7c5807bed5141",
"event_fingerprint": "a592af621460a1b52dd4f05971a48e6066ebd422",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 4
},
"service_name": "weblogic-cluster",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7007,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 4
},
"payload_preview": "256\u0000",
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"evidence": {
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00da02381fe59fdf7509328b39d6801a4ac5ca2b",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 7007,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"evidence_snippet": "256",
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
"target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 4
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 4,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7007,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 7007,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
"evidence_snippet": "256",
"target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7007 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7007 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7007
Chemin / cible
—
Service
WEBLOGIC CLUSTER
Payload
�-+��Z�\�������J���ώp1����u�j7��R3�,�b8տ�iBUq��5d�m�ʱ9�����5Xş�Z�g�~C��eoc> �d`�*��F5�� 9 �&j��E�ٌ|b����tCY�}OI��
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�-+��Z�\�������J���ώp1����u�j7��R3�,�b8տ�iBUq��5d�m�ʱ9�����5Xş�Z�g�~C��eoc> �d`�*��F5��
9 �&j��E�ٌ|b����tCY�}OI��
Requête brute (extrait)
�-+��Z�\�������J���ώp1����u�j7��R3�,�b8տ�iBUq��5d�m�ʱ9�����5Xş�Z�g�~C��eoc> �d`�*��F5�� 9 �&j��E�ٌ|b����tCY�}OI����.S'�f�3�L@OT��_A�o��I�Ѽ��_�V���ϫ_5���=ޑZOB�w���S�5�J� �e�� d���i��3�^i�e�c.Y�c;M���AP�R���C9��r�}p� ?�Tm��Kf
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 256,
"payload_entropy": 7.105187818381616,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7007,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "738e0f1b893df8792a9cf1e422d7c5807bed5141",
"event_fingerprint": "a592af621460a1b52dd4f05971a48e6066ebd422",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "weblogic-cluster",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b187dc606696763e28a5b2a8aef3887",
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7007,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 0
},
"payload_preview": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"request_sample": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\ufffd\ufffd.S'\ufffd\u0002f\ufffd3\u0014\ufffdL@OT\ufffd\u001b\ufffd_A\b\ufffdo\u0015\ufffd\u0004\ufffdI\ufffd\u047c\u0013\ufffd\ufffd_\ufffdV\ufffd\ufffd\ufffd\u03eb_5\ufffd\ufffd\ufffd=\u0791ZOB\ufffd\u001aw\ufffd\ufffd\ufffdS\ufffd5\ufffdJ\ufffd\r\ufffde\ufffd\ufffd\u001fd\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd^i\ufffde\ufffdc\u0014.Y\ufffdc;M\ufffd\u0014\u000f\ufffd\ufffdA\u0003P\ufffdR\ufffd\ufffd\ufffdC9\ufffd\ufffdr\ufffd}\u0006p\ufffd\f?\ufffdTm\ufffd\ufffdKf",
"payload_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\ufffd\ufffd.S'\ufffd\u0002f\ufffd3\u0014\ufffdL@OT\ufffd\u001b\ufffd_A\b\ufffdo\u0015\ufffd\u0004\ufffdI\ufffd\u047c\u0013\ufffd\ufffd_\ufffdV\ufffd\ufffd\ufffd\u03eb_5\ufffd\ufffd\ufffd=\u0791ZOB\ufffd\u001aw\ufffd\ufffd\ufffdS\ufffd5\ufffdJ\ufffd\r\ufffde\ufffd\ufffd\u001fd\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd^i\ufffde\ufffdc\u0014.Y\ufffdc;M\ufffd\u0014\u000f\ufffd\ufffdA\u0003P\ufffdR\ufffd\ufffd\ufffdC9\ufffd\ufffdr\ufffd}\u0006p\ufffd\f?\ufffdTm\ufffd\ufffdKf",
"payload_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "25ff962c78ca5a6f0406f1063173966d1430e9b8",
"protocol_details": {
"payload_preview": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"port": 7007,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"evidence_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\ufffd,\ufffdb8\u057f\ufffdiBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF5\ufffd\ufffd\n9 \ufffd&j\ufffd\ufffdE\ufffd\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
"target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7007,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"port": 7007,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\ufffd,\ufffdb8\u057f\ufffdiBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF5\ufffd\ufffd\n9 \ufffd&j\ufffd\ufffdE\ufffd\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
"target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7007 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7007 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7007
Chemin / cible
—
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7007,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "738e0f1b893df8792a9cf1e422d7c5807bed5141",
"event_fingerprint": "a592af621460a1b52dd4f05971a48e6066ebd422",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "weblogic-cluster",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7007,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81897d56a9ec6f5d31882a5c8de648933b78c6be",
"protocol_details": {
"port": 7007,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
"target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7007,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 7007,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7004 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7004 · (sonde / probe)
|
Faible
|
Faible · 8
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7004
Chemin / cible
—
Service
WEBLOGIC CLUSTER
Payload
256
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 8
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4,
"payload_entropy": 2,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7004,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 8,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
"event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"service_name": "weblogic-cluster",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7004,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 8
},
"payload_preview": "256\u0000",
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"evidence": {
"request_sample": "256\u0000",
"payload_snippet": "256\u0000",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8741011ce6c28ed5660a70f6db07e89d6a2e1120",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 7004,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"evidence_snippet": "256",
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
"target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 8,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7004,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "256\u0000",
"port": 7004,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
"evidence_snippet": "256",
"target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7004 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7004 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7004
Chemin / cible
—
Service
WEBLOGIC CLUSTER
Payload
u,��b�ce�h�����PI�����D����[�x���n?�I�%��[U�]C�^G�>�2���|�d���^LKPl uA-��#`w�c�̹�(�傓_��m-� �L�i-�ɠ�ٶ��n�yt����a
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
u,��b�ce�h�����PI�����D����[�x���n?�I�%��[U�]C�^G�>�2���|�d���^LKPl uA-��#`w�c�̹�(�傓_��m-� �L�i-�ɠ�ٶ��n�yt����a
Requête brute (extrait)
u,��b�ce�h�����PI�����D����[�x���n?�I�%��[U�]C�^G�>�2���|�d���^LKPl uA-��#`w�c�̹�(�傓_��m-� �L�i-�ɠ�ٶ��n�yt����a3%y`I�@ \�$�"�v]��^��g&Ơ��i��c��R[�>B�� �OA�x�|N�8`p_eg#�g�C� ��;�=�)D�� D�p+�]p�jD�h- �>��� d̹��#����� ���hW�"��;E�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 256,
"payload_entropy": 7.150537976484885,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7004,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
"event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "weblogic-cluster",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "896d38842f6a9907b5315fc8eddaf29b",
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7004,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 0
},
"payload_preview": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
"request_sample": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda3%y`I\ufffd@\n\\\ufffd$\ufffd\"\ufffdv\u0005\u001a]\ufffd\ufffd^\u0002\ufffd\ufffdg&\u01a0\ufffd\u0014\ufffdi\ufffd\ufffdc\ufffd\ufffdR[\ufffd>B\ufffd\ufffd\u001f\ufffdOA\ufffdx\ufffd|N\ufffd8`p_eg#\ufffdg\ufffdC\ufffd\u001d\ufffd\ufffd;\ufffd\u0014=\ufffd)D\ufffd\ufffd\u001fD\u000f\ufffdp+\ufffd]p\ufffdjD\ufffdh-\u001e\ufffd>\ufffd\u0002\ufffd\ufffd\rd\u0339\ufffd\ufffd#\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffdhW\ufffd\"\ufffd\ufffd;E\u0005\ufffd",
"payload_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
"evidence": {
"request_sample": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda3%y`I\ufffd@\n\\\ufffd$\ufffd\"\ufffdv\u0005\u001a]\ufffd\ufffd^\u0002\ufffd\ufffdg&\u01a0\ufffd\u0014\ufffdi\ufffd\ufffdc\ufffd\ufffdR[\ufffd>B\ufffd\ufffd\u001f\ufffdOA\ufffdx\ufffd|N\ufffd8`p_eg#\ufffdg\ufffdC\ufffd\u001d\ufffd\ufffd;\ufffd\u0014=\ufffd)D\ufffd\ufffd\u001fD\u000f\ufffdp+\ufffd]p\ufffdjD\ufffdh-\u001e\ufffd>\ufffd\u0002\ufffd\ufffd\rd\u0339\ufffd\ufffd#\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffdhW\ufffd\"\ufffd\ufffd;E\u0005\ufffd",
"payload_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75cb19fe7a3ede139d21deeb0def71ca5a323724",
"protocol_details": {
"payload_preview": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
"port": 7004,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"evidence_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffdx\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd]C\ufffd^G\ufffd>\ufffd2\ufffd\ufffd\ufffd|\ufffdd\ufffd\ufffd\ufffd^LKPluA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\ufffd\ufffda",
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
"target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7004,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
"port": 7004,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
"evidence_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffdx\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd]C\ufffd^G\ufffd>\ufffd2\ufffd\ufffd\ufffd|\ufffdd\ufffd\ufffd\ufffd^LKPluA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\ufffd\ufffda",
"target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7004 · WEBLOGIC CLUSTER
|
weblogic-cluster
|
Sonde WebLogic
weblogic-cluster · via WEBLOGIC CLUSTER:7004 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC-CLUSTER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7004
Chemin / cible
—
Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "weblogic-cluster",
"app_proto": "weblogic-cluster",
"asn": 219502,
"country": "NL",
"dst_port": 7004,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
"event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "weblogic-cluster",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
},
"target_context": {
"dst_port": 7004,
"service": "weblogic-cluster",
"service_name": "weblogic-cluster",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd9ee6f68a52bb7e7e3192a8b302252b85f427c8",
"protocol_details": {
"port": 7004,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
"target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER",
"dst_port": 7004,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic-cluster",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 7004,
"service": "weblogic-cluster",
"service_label_fr": "WEBLOGIC CLUSTER"
},
"attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
"emulator_service": "weblogic-cluster",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic_cluster",
"service_banner": "honeypot-weblogic-cluster",
"service_os": "linux",
"dst_port": "7004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|