|
|
TCP |
2082 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:2082 · (tentative d'exploit) · → /login/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /login/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/login/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
2082
Chemin / cible
/login/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
cPanel login path
Ligne de requête
POST /login/?login_only=1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login/?login_only=1 HTTP/1.1
Accept-Encoding: identity
Content-Length: 20
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /login/?login_only=1 HTTP/1.1 Accept-Encoding: identity Content-Length: 20 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept: */* Connection: close Host: 62.3.50.33
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 7,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "72a6417447093c38eaea8e6e90915f55b90c288c",
"http_host_hash": "4319c7ade0bba7afb97efbb687810dc600e3e05b",
"http_target_hash": "8867d3379ac5bf62897f1378b18a6965af39ff3a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 334,
"payload_entropy": 5.4311918422916206,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2082,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "f1e7caba6a9e0962f7b68524d612870ccf81b84f",
"event_fingerprint": "dce800a6fc0a3262a3023c5a68eb377ee9d5f32b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0618"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"cPanel login path"
],
"pattern_ids": [
"pat-0842",
"pat-0618"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7526c00e18367b920e093b58c42973f7",
"payload_hash": "36e71b6aac7d306f8f5b80bf1a0f51d3",
"path_pattern_hash": "846b3460b625ad1b1254c9016233442b"
},
"target_context": {
"dst_port": 2082,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/login\/",
"query_string": "login_only=1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nHost: 62.3.50.33",
"payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/login\/",
"query_string": "login_only=1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nHost: 62.3.50.33",
"payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a358f3afebcc6a714b0c3934884cfd2aed0c409",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login\/",
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2082,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/login\/",
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/",
"evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_login",
"net_web_probe"
]
}
|
|
|
TCP |
2082 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:2082 · (tentative d'exploit) · → /openid_connect/cpanelid
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /openid_connect/cpanelid UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Surveiller
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_admin_panel_scan
Cible HTTP
GET
/openid_connect/cpanelid
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2082
Chemin / cible
/openid_connect/cpanelid
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /openid_connect/cpanelid HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /openid_connect/cpanelid HTTP/1.1
Accept-Encoding: identity
Host: 62.3.50.33:2082
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
GET /openid_connect/cpanelid HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:2082 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "72a6417447093c38eaea8e6e90915f55b90c288c",
"http_host_hash": "4319c7ade0bba7afb97efbb687810dc600e3e05b",
"http_target_hash": "08a3ffc0b8ecd02c42600619d8011c3bbca5791e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 248,
"payload_entropy": 5.335385360496563,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2082,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 49,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "980a2f5aa81c5cc43d7027443e17eba076a98b6e",
"event_fingerprint": "8447e7fc7673d0699ec82f9ee9a707811c2d96e8",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7526c00e18367b920e093b58c42973f7",
"payload_hash": "cccfbcc8b6d84ad7d62e663b156ff2fc",
"path_pattern_hash": "e20f1efb1757fb88ce46feb9e6081802"
},
"target_context": {
"dst_port": 2082,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a610329babf72539808c93f659970fe2be68439",
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "exploit attempt \u00b7 via HTTP:2082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2082,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:2082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid",
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_admin_panel_scan",
"net_web_probe"
]
}
|
|
|
TCP |
2083 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:2083 · (tentative d'exploit) · → /openid_connect/cpanelid
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /openid_connect/cpanelid UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_admin_panel_scan
Cible HTTP
GET
/openid_connect/cpanelid
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2083
Chemin / cible
/openid_connect/cpanelid
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 50
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /openid_connect/cpanelid HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /openid_connect/cpanelid HTTP/1.1
Accept-Encoding: identity
Host: 62.3.50.33:2083
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
GET /openid_connect/cpanelid HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:2083 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "72a6417447093c38eaea8e6e90915f55b90c288c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "08a3ffc0b8ecd02c42600619d8011c3bbca5791e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 248,
"payload_entropy": 5.32895944096659,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2083,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "57aac5a0f956ed040bddaad5a37d3595248fd8c5",
"event_fingerprint": "76594bf4a7df6d65afa61051e7ad9bbbba85f7d9",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7526c00e18367b920e093b58c42973f7",
"payload_hash": "42ed6d241e5d96e07b9cda50a4bde8c1",
"path_pattern_hash": "e20f1efb1757fb88ce46feb9e6081802"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e76e160690962c8c57ff6b1ffff95664c0825d5f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid",
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:2083\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_admin_panel_scan",
"net_web_probe"
]
}
|
|
|
TCP |
2083 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:2083 · (tentative d'exploit) · → /login/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /login/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/login/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
2083
Chemin / cible
/login/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
cPanel login path
Ligne de requête
POST /login/?login_only=1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login/?login_only=1 HTTP/1.1
Accept-Encoding: identity
Content-Length: 20
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /login/?login_only=1 HTTP/1.1 Accept-Encoding: identity Content-Length: 20 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept: */* Connection: close Host: 62.3.50.33
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 7,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "72a6417447093c38eaea8e6e90915f55b90c288c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "8867d3379ac5bf62897f1378b18a6965af39ff3a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 334,
"payload_entropy": 5.427888240352218,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "aa298d089beef2127dc3d35f6f4565999e78dba5",
"event_fingerprint": "d525a5e9fc19a0376430a62d72689974824b6ddc",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0618"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"cPanel login path"
],
"pattern_ids": [
"pat-0842",
"pat-0618"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7526c00e18367b920e093b58c42973f7",
"payload_hash": "36e71b6aac7d306f8f5b80bf1a0f51d3",
"path_pattern_hash": "846b3460b625ad1b1254c9016233442b"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/login\/",
"query_string": "login_only=1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nHost: 62.3.50.33",
"payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/login\/",
"query_string": "login_only=1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nHost: 62.3.50.33",
"payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b76e92456c9f20521e630d812f386cd52c6a08de",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login\/",
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/login\/",
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/146.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/",
"evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 20\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_login",
"net_web_probe"
]
}
|
|
|
TCP |
2082 · HTTP
|
http
|
Sonde port 2082/TCP
port 2082 tcp · via HTTP:2082 · (sonde / probe) · → /openid_connect/cpanelid
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /openid_connect/cpanelid UA python-requests/2.32.3
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_admin_panel_scan
Cible HTTP
GET
/openid_connect/cpanelid
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2082
Chemin / cible
/openid_connect/cpanelid
Preuve honeypot — Sonde port 2082/TCP
Connexion détectée sur le port 2082 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2082_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /openid_connect/cpanelid HTTP/1.1
User-Agent
python-requests/2.32.3
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /openid_connect/cpanelid HTTP/1.1
Host: 62.3.50.33:2082
User-Agent: python-requests/2.32.3
Accept-Encoding: gzip, deflate
Requête brute (extrait)
GET /openid_connect/cpanelid HTTP/1.1 Host: 62.3.50.33:2082 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "ae09ca118a34f21eadeb922152bc0d66d5b1783f",
"http_host_hash": "4319c7ade0bba7afb97efbb687810dc600e3e05b",
"http_target_hash": "08a3ffc0b8ecd02c42600619d8011c3bbca5791e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 164,
"payload_entropy": 5.006558078352917,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2082,
"risk_waf": 44,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 41,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "7722c4744a0465b8d687c4fa0d49f35ededb7eea",
"event_fingerprint": "7a4ae101c3f8415a979e0c38be19e64b80d3e399",
"classification_reason": "Type \u00ab port_2082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bcea973b42c25e2780c70435dae7b4a0",
"payload_hash": "1294cfc4bb3bd38a86bbb63cfc46916b",
"path_pattern_hash": "e20f1efb1757fb88ce46feb9e6081802"
},
"target_context": {
"dst_port": 2082,
"service": "http",
"service_name": "http",
"risk_score": 41
},
"payload_preview": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "python-requests\/2.32.3",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"evidence": {
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "python-requests\/2.32.3",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"classification_reason": "Type \u00ab port_2082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee8d9a6bdbb8d08a28b93689135e46bfffc61682",
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.3",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"attack_vector": "port 2082 tcp \u00b7 via HTTP:2082 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openid_connect\/cpanelid",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_2082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2082,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.3",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2082 tcp \u00b7 via HTTP:2082 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openid_connect\/cpanelid",
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2082\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_admin_panel_scan",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
2082 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:2082 · (tentative d'exploit) · → /login/
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /login/ UA Mozilla/5.0 cPanel-WHM-CVE-2026-41940-Verifier
Émulateur
HTTP
WAF
6
Recommandation
Investiguer
Tags
950468:nosqli-3
http_probe_login
net_web_probe
Cible HTTP
POST
/login/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
2082
Chemin / cible
/login/
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
cPanel login path
Ligne de requête
POST /login/?login_only=1 HTTP/1.1
User-Agent
Mozilla/5.0 cPanel-WHM-CVE-2026-41940-Verifier
Règles WAF
nosqli-3
Payload (extrait)
POST /login/?login_only=1 HTTP/1.1
User-Agent: Mozilla/5.0 cPanel-WHM-CVE-2026-41940-Verifier
Accept-Encoding: gzip, deflate
Requête brute (extrait)
POST /login/?login_only=1 HTTP/1.1 User-Agent: Mozilla/5.0 cPanel-WHM-CVE-2026-41940-Verifier Accept-Encoding: gzip, deflate Accept: */* Connection: close Host: 62.3.50.33:2082 Content-Length: 20 Content-Type: application/x-www-form-urlencoded
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 7,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "ba0d7ed6a5675fbebcd36e4ea990e83872f4a431",
"http_host_hash": "4319c7ade0bba7afb97efbb687810dc600e3e05b",
"http_target_hash": "8867d3379ac5bf62897f1378b18a6965af39ff3a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.261330138873314,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2082,
"risk_waf": 32,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "762052ae7e9b42f5b599e48abe8728b7221feb6c",
"event_fingerprint": "63d2af6419819126d1dc8eb9746dc5f2c3505b39",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0618"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"cPanel login path"
],
"pattern_ids": [
"pat-0842",
"pat-0618"
],
"confidence_breakdown": {
"waf": 32,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3b933f3748114af8062f86fd273842b6",
"payload_hash": "c7b245ac73b7a98410eeebfeec60f774",
"path_pattern_hash": "846b3460b625ad1b1254c9016233442b"
},
"target_context": {
"dst_port": 2082,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate\r\n",
"method": "POST",
"path": "\/login\/",
"query_string": "login_only=1",
"user_agent": "Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: close\r\nHost: 62.3.50.33:2082\r\nContent-Length: 20\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\n",
"payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate",
"evidence": {
"method": "POST",
"path": "\/login\/",
"query_string": "login_only=1",
"user_agent": "Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: close\r\nHost: 62.3.50.33:2082\r\nContent-Length: 20\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\n",
"payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4ab975b2ae262cb68e2e5417952271474ce5085",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login\/",
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 32,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2082,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/login\/",
"request_line": "POST \/login\/?login_only=1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier",
"port": 2082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/",
"evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 cPanel-WHM-CVE-2026-41940-Verifier\r\nAccept-Encoding: gzip, deflate",
"target_port_label": "2082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"http_probe_login",
"net_web_probe"
]
}
|
|
|
TCP |
2083 · HTTP
|
http
|
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe) · → /openid_connect/cpanelid
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /openid_connect/cpanelid UA python-requests/2.32.3
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_admin_panel_scan
Cible HTTP
GET
/openid_connect/cpanelid
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2083
Chemin / cible
/openid_connect/cpanelid
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /openid_connect/cpanelid HTTP/1.1
User-Agent
python-requests/2.32.3
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /openid_connect/cpanelid HTTP/1.1
Host: 62.3.50.33:2083
User-Agent: python-requests/2.32.3
Accept-Encoding: gzip, deflate
Requête brute (extrait)
GET /openid_connect/cpanelid HTTP/1.1 Host: 62.3.50.33:2083 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "ae09ca118a34f21eadeb922152bc0d66d5b1783f",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "08a3ffc0b8ecd02c42600619d8011c3bbca5791e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 164,
"payload_entropy": 5.004786773136739,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "http",
"app_proto": "http",
"asn": 401696,
"country": "HK",
"dst_port": 2083,
"risk_waf": 44,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 41,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "4d8202d3c62874a1a017411fb0bf3df04f507a9f",
"event_fingerprint": "f9ca2545153a857e8e2aa0610dae15f2a66bc1b0",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bcea973b42c25e2780c70435dae7b4a0",
"payload_hash": "7aaed8295d7579fe9cc9db1c0735cb77",
"path_pattern_hash": "e20f1efb1757fb88ce46feb9e6081802"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 41
},
"payload_preview": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "python-requests\/2.32.3",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"evidence": {
"method": "GET",
"path": "\/openid_connect\/cpanelid",
"user_agent": "python-requests\/2.32.3",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e5bbfa871e7e966425234dfe66ff883567382b3d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.3",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openid_connect\/cpanelid",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 44,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/openid_connect\/cpanelid",
"request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.3",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openid_connect\/cpanelid",
"evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nUser-Agent: python-requests\/2.32.3\r\nAccept-Encoding: gzip, deflate",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_admin_panel_scan",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
2083 · CPANEL SSL
|
cpanel-ssl
|
cpanel probe
cpanel probe · via CPANEL SSL:2083 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-SSL
WAF
—
Recommandation
Surveiller
Tags
cpanel_ssl_emulated
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2083
Chemin / cible
—
Service
CPANEL SSL
Payload
�9�'��:S;Z��r�5��{@7�(D��V�u�6�� ��`Ҁy ���^������� %� ӿ��v� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�9�'��:S;Z��r�5��{@7�(D��V�u�6�� ��`Ҁy ���^������� %� ӿ��v� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�9�'��:S;Z��r�5��{@7�(D��V�u�6�� ��`Ҁy ���^������� %� ӿ��v� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 517,
"payload_entropy": 3.9457437160143805,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "cpanel-ssl",
"app_proto": "cpanel-ssl",
"asn": 401696,
"country": "HK",
"dst_port": 2083,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090",
"event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "cpanel-ssl",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3bd22860afdcb5ba578ab16c37842d30",
"path_pattern_hash": "e7139612faef5d92b03716e3491ff506"
},
"target_context": {
"dst_port": 2083,
"service": "cpanel-ssl",
"service_name": "cpanel-ssl",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00039\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\u0003\ufffd \ufffd\ufffd`\u0480\u0013y\u001e\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b%\ufffd\u001d\f\u04ff\ufffd\ufffd\u0010v\ufffd\u001f\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00039\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\u0003\ufffd \ufffd\ufffd`\u0480\u0013y\u001e\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b%\ufffd\u001d\f\u04ff\ufffd\ufffd\u0010v\ufffd\u001f\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00039\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\u0003\ufffd \ufffd\ufffd`\u0480\u0013y\u001e\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b%\ufffd\u001d\f\u04ff\ufffd\ufffd\u0010v\ufffd\u001f\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "295eafb1dfbe1efefe189df43436084e1530673d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00039\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\u0003\ufffd \ufffd\ufffd`\u0480\u0013y\u001e\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b%\ufffd\u001d\f\u04ff\ufffd\ufffd\u0010v\ufffd\u001f\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"evidence_snippet": "\ufffd9\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\ufffd \ufffd\ufffd`\u0480y\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\u04ff\ufffd\ufffdv\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "cpanel-ssl",
"service_label_fr": "CPANEL SSL",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-ssl",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00039\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\u0003\ufffd \ufffd\ufffd`\u0480\u0013y\u001e\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b%\ufffd\u001d\f\u04ff\ufffd\ufffd\u0010v\ufffd\u001f\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd9\ufffd'\ufffd\ufffd:S;Z\ufffd\ufffdr\ufffd5\ufffd\ufffd{@7\ufffd(D\ufffd\ufffdV\ufffdu\ufffd6\ufffd\ufffd \ufffd\ufffd`\u0480y\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\u04ff\ufffd\ufffdv\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_ssl",
"service_banner": "honeypot-cpanel-ssl",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel",
"cpanel-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_ssl_emulated",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2083 · CPANEL SSL
|
cpanel-ssl
|
cpanel probe
cpanel probe · via CPANEL SSL:2083 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-SSL
WAF
—
Recommandation
Surveiller
Tags
cpanel_ssl_emulated
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2083
Chemin / cible
—
Service
CPANEL SSL
Payload
�z{SLM��Kdik^;�T�QL{q� l�o5�m �d 6yX�T�ahٺ�ٺ]��~��!�w�K�ì >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�z{SLM��Kdik^;�T�QL{q� l�o5�m �d 6yX�T�ahٺ�ٺ]��~��!�w�K�ì >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�z{SLM��Kdik^;�T�QL{q� l�o5�m �d 6yX�T�ahٺ�ٺ]��~��!�w�K�ì >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 517,
"payload_entropy": 3.953840148719476,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "cpanel-ssl",
"app_proto": "cpanel-ssl",
"asn": 401696,
"country": "HK",
"dst_port": 2083,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090",
"event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "cpanel-ssl",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48f5623ba46111a07d2d40a24524b818",
"path_pattern_hash": "e7139612faef5d92b03716e3491ff506"
},
"target_context": {
"dst_port": 2083,
"service": "cpanel-ssl",
"service_name": "cpanel-ssl",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003z{\u0007SLM\ufffd\ufffdKdik^;\ufffdT\b\ufffdQL{q\ufffd\u001cl\ufffdo\u00015\u0007\ufffdm \ufffdd\u000b6yX\u000e\ufffdT\ufffdah\u067a\ufffd\u067a]\u0002\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003z{\u0007SLM\ufffd\ufffdKdik^;\ufffdT\b\ufffdQL{q\ufffd\u001cl\ufffdo\u00015\u0007\ufffdm \ufffdd\u000b6yX\u000e\ufffdT\ufffdah\u067a\ufffd\u067a]\u0002\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003z{\u0007SLM\ufffd\ufffdKdik^;\ufffdT\b\ufffdQL{q\ufffd\u001cl\ufffdo\u00015\u0007\ufffdm \ufffdd\u000b6yX\u000e\ufffdT\ufffdah\u067a\ufffd\u067a]\u0002\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b89620b8cce584964dd48c30c769928e33d17ec",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003z{\u0007SLM\ufffd\ufffdKdik^;\ufffdT\b\ufffdQL{q\ufffd\u001cl\ufffdo\u00015\u0007\ufffdm \ufffdd\u000b6yX\u000e\ufffdT\ufffdah\u067a\ufffd\u067a]\u0002\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"evidence_snippet": "\ufffdz{SLM\ufffd\ufffdKdik^;\ufffdT\ufffdQL{q\ufffdl\ufffdo5\ufffdm \ufffdd6yX\ufffdT\ufffdah\u067a\ufffd\u067a]\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "cpanel-ssl",
"service_label_fr": "CPANEL SSL",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-ssl",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003z{\u0007SLM\ufffd\ufffdKdik^;\ufffdT\b\ufffdQL{q\ufffd\u001cl\ufffdo\u00015\u0007\ufffdm \ufffdd\u000b6yX\u000e\ufffdT\ufffdah\u067a\ufffd\u067a]\u0002\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdz{SLM\ufffd\ufffdKdik^;\ufffdT\ufffdQL{q\ufffdl\ufffdo5\ufffdm \ufffdd6yX\ufffdT\ufffdah\u067a\ufffd\u067a]\ufffd\ufffd~\ufffd\ufffd!\ufffdw\ufffdK\ufffd\u00ec>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_ssl",
"service_banner": "honeypot-cpanel-ssl",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel",
"cpanel-ssl"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_ssl_emulated",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2082 · CPANEL
|
cpanel
|
cpanel probe
cpanel probe · via CPANEL:2082 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL
WAF
—
Recommandation
Surveiller
Tags
cpanel_emulated
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2082
Chemin / cible
—
Service
CPANEL
Payload
��,*���&�[n�t+=���8�ۂ`����D ��VI 憿ey��@ k���yح�r�o������i�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��,*���&�[n�t+=���8�ۂ`����D ��VI 憿ey��@ k���yح�r�o������i�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��,*���&�[n�t+=���8�ۂ`����D ��VI 憿ey��@ k���yح�r�o������i�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 517,
"payload_entropy": 3.973269000428615,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "cpanel",
"app_proto": "cpanel",
"asn": 401696,
"country": "HK",
"dst_port": 2082,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ed613783166dd900089e41f9811da7ec01896773",
"event_fingerprint": "2ba81f55f1429aafe8b166faf2b84499ed62bf27",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "cpanel",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3e630ab8017632a8c9ead28a27046a12",
"path_pattern_hash": "e7139612faef5d92b03716e3491ff506"
},
"target_context": {
"dst_port": 2082,
"service": "cpanel",
"service_name": "cpanel",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfe\u000ey\ufffd\ufffd@\u0017\u001fk\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfe\u000ey\ufffd\ufffd@\u0017\u001fk\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfe\u000ey\ufffd\ufffd@\u0017\u001fk\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58e1a71ca3f47b25eb01d6fb44b65d082b20ddc4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfe\u000ey\ufffd\ufffd@\u0017\u001fk\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2082,
"service": "cpanel",
"service_label_fr": "CPANEL"
},
"evidence_snippet": "\ufffd\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfey\ufffd\ufffd@k\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "cpanel probe \u00b7 via CPANEL:2082 \u00b7 (sonde \/ probe)",
"target_port_label": "2082 \u00b7 CPANEL",
"emulator_service": "cpanel",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "cpanel",
"service_label_fr": "CPANEL",
"dst_port": 2082,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfe\u000ey\ufffd\ufffd@\u0017\u001fk\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2082,
"service": "cpanel",
"service_label_fr": "CPANEL"
},
"attack_vector": "cpanel probe \u00b7 via CPANEL:2082 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd,*\ufffd\ufffd\ufffd&\ufffd[n\ufffdt+=\ufffd\ufffd\ufffd8\ufffd\u06c2`\ufffd\ufffd\ufffd\ufffdD \ufffd\ufffdVI \u61bfey\ufffd\ufffd@k\ufffd\ufffd\ufffdy\u062d\ufffdr\ufffdo\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "2082 \u00b7 CPANEL",
"emulator_service": "cpanel",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel",
"service_banner": "honeypot-cpanel",
"service_os": "linux",
"dst_port": "2082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_emulated",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2082 · CPANEL
|
cpanel
|
cpanel probe
cpanel probe · via CPANEL:2082 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL
WAF
—
Recommandation
Surveiller
Tags
cpanel_emulated
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2082
Chemin / cible
—
Service
CPANEL
Payload
�*��o�:ɒ�j��=�T���ã�>nX���� � � =��= ��W���F�N��N��v�R�� U >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�*��o�:ɒ�j��=�T���ã�>nX���� � � =��= ��W���F�N��N��v�R�� U >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�*��o�:ɒ�j��=�T���ã�>nX���� � � =��= ��W���F�N��N��v�R�� U >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 517,
"payload_entropy": 3.9785332912421167,
"port_category": "registered",
"org": "cognetcloud INC",
"service": "cpanel",
"app_proto": "cpanel",
"asn": 401696,
"country": "HK",
"dst_port": 2082,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ed613783166dd900089e41f9811da7ec01896773",
"event_fingerprint": "2ba81f55f1429aafe8b166faf2b84499ed62bf27",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "cpanel",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 401696,
"org": "cognetcloud INC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4e519bc133e48243c05d569f35207dbf",
"path_pattern_hash": "e7139612faef5d92b03716e3491ff506"
},
"target_context": {
"dst_port": 2082,
"service": "cpanel",
"service_name": "cpanel",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\u000e\u0019\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\u0014\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffd\u000bU\u001d\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\u000e\u0019\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\u0014\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffd\u000bU\u001d\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\u000e\u0019\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\u0014\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffd\u000bU\u001d\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6caf7550e5d55b7cf3d2cf8ee3778b243b091acb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\u000e\u0019\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\u0014\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffd\u000bU\u001d\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2082,
"service": "cpanel",
"service_label_fr": "CPANEL"
},
"evidence_snippet": "\ufffd*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffdU>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "cpanel probe \u00b7 via CPANEL:2082 \u00b7 (sonde \/ probe)",
"target_port_label": "2082 \u00b7 CPANEL",
"emulator_service": "cpanel",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "cpanel",
"service_label_fr": "CPANEL",
"dst_port": 2082,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\u000e\u0019\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\u0014\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffd\u000bU\u001d\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 2082,
"service": "cpanel",
"service_label_fr": "CPANEL"
},
"attack_vector": "cpanel probe \u00b7 via CPANEL:2082 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd*\ufffd\ufffdo\ufffd:\u0252\ufffdj\ufffd\ufffd=\ufffdT\ufffd\ufffd\ufffd\u00e3\ufffd>nX\ufffd\ufffd\ufffd\ufffd \ufffd \ufffd\t=\ufffd\ufffd= \ufffd\ufffdW\ufffd\ufffd\ufffdF\ufffdN\ufffd\ufffdN\ufffd\ufffdv\ufffdR\ufffd\ufffdU>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "2082 \u00b7 CPANEL",
"emulator_service": "cpanel",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel",
"service_banner": "honeypot-cpanel",
"service_os": "linux",
"dst_port": "2082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_emulated",
"net_cpanel_probe",
"tls_clienthello"
]
}
|