|
|
TCP |
7001 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:7001 · (tentative d'exploit) · → /administrator
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /administrator UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_joomla
Cible HTTP
GET
/administrator
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/administrator
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 46
Confiance : Confiance 54 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
ES admin GET
ActiveMQ console
Ligne de requête
GET /administrator HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /administrator HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Ac
Requête brute (extrait)
GET /administrator HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "777ebe7c09e81f3882c31066d03f7a1de4ec47bb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.109573495684124,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b1962c88398f7251e7b82368057e1fe52c94eed6",
"event_fingerprint": "baa733331a9b1568ada344c2758640941aa49a37",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0324",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "bfcc0fdc9e2e5a9eba49229943ae2cc7",
"path_pattern_hash": "f9d6a63dc1f476fb68acf5274e44c338"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAc",
"method": "GET",
"path": "\/administrator",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/administrator HTTP\/1.1",
"request_sample": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAc",
"evidence": {
"method": "GET",
"path": "\/administrator",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/administrator HTTP\/1.1",
"request_sample": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAc",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e48fa61355bb6acb5c82f9cd9a9c3d689e9a054",
"protocol_details": {
"http_method": "GET",
"http_path": "\/administrator",
"request_line": "GET \/administrator HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAc",
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/administrator",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/administrator",
"request_line": "GET \/administrator HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/administrator",
"evidence_snippet": "GET \/administrator HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAc",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_joomla",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7001 · (tentative d'exploit) · → /admin.php
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin.php UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
http_admin_panel_probe
http_probe_admin
http_sensitive_path
Cible HTTP
GET
/admin.php
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/admin.php
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
ES admin GET
Probe /admin.php
ActiveMQ console
Ligne de requête
GET /admin.php HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /admin.php HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Accept
Requête brute (extrait)
GET /admin.php HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "bab5871b622b1c3d205151706ae067e078ec96d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 161,
"payload_entropy": 5.111882923409269,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fe9362df4f96f166bcbe57c9cfcc6e0f481561a0",
"event_fingerprint": "42786e36a10121c14aa7c66040ba50d89464d51a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0324",
"pat-0341",
"pat-0236",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"ES admin GET",
"Probe \/admin.php",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0324",
"pat-0341",
"pat-0236",
"pat-0606"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "d4fde0e5dd9c6ae252777d9036691147",
"path_pattern_hash": "06734ee7382e86e5b9780c73ecf4960c"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"method": "GET",
"path": "\/admin.php",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/admin.php HTTP\/1.1",
"request_sample": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/admin.php",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/admin.php HTTP\/1.1",
"request_sample": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3895ee39b16b76548fdcc83a21c9b614e07846d9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin.php",
"request_line": "GET \/admin.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin.php",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin.php",
"request_line": "GET \/admin.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin.php",
"evidence_snippet": "GET \/admin.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"http_admin_panel_probe",
"http_probe_admin",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7001 · (tentative d'exploit) · → /wp-admin
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-admin UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950503:cms-1
http_admin_panel_probe
http_probe_wp_admin
Cible HTTP
GET
/wp-admin
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/wp-admin
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /wp-admin HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
cms-1
Payload (extrait)
GET /wp-admin HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Accept:
Requête brute (extrait)
GET /wp-admin HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "8a6d78a6e61fd03011c16f84332b414428885b02",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 160,
"payload_entropy": 5.133927346996574,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e751f346ec766dec8dbe0f4195437e3420d83f42",
"event_fingerprint": "5f7aa736dfd6631b8edd0244e9f9ea7368f27162",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "5643f6f5a0800ed56c97037adc404258",
"path_pattern_hash": "07751eb5a446e6a61bf0e99082ed3ff0"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"method": "GET",
"path": "\/wp-admin",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3",
"950503:cms-1"
],
"waf_rule_names": [
"nosqli-3",
"cms-1"
],
"request_line": "GET \/wp-admin HTTP\/1.1",
"request_sample": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"evidence": {
"method": "GET",
"path": "\/wp-admin",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3",
"950503:cms-1"
],
"waf_rule_names": [
"nosqli-3",
"cms-1"
],
"request_line": "GET \/wp-admin HTTP\/1.1",
"request_sample": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f899b2bbcead4848bddbb5536d9dfa78fb14bac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-admin",
"request_line": "GET \/wp-admin HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-admin",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-admin",
"request_line": "GET \/wp-admin HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-admin",
"evidence_snippet": "GET \/wp-admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950503:cms-1",
"http_admin_panel_probe",
"http_probe_wp_admin",
"http_sensitive_path",
"http_wp_scan",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7001 · (tentative d'exploit) · → /wp-login.php
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-login.php UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950502:cms-0
http_probe_wp_login
http_sensitive_path
Cible HTTP
GET
/wp-login.php
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/wp-login.php
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
ET WP login
Ligne de requête
GET /wp-login.php HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
cms-0
Payload (extrait)
GET /wp-login.php HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Acc
Requête brute (extrait)
GET /wp-login.php HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "4d8ef3d3642fd19f0a74cb5666752d1aeef6612b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 164,
"payload_entropy": 5.115797424875261,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 44,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8e3758dfbe1262d7596eaec18a9d6265c267d5ae",
"event_fingerprint": "831bc518a564e92c8d88c439a8f761beaf9c70da",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0324",
"pat-0851"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"ET WP login"
],
"pattern_ids": [
"pat-0324",
"pat-0851"
],
"confidence_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "1fac36c54c455d972ff0ca26e53eb719",
"path_pattern_hash": "df475dccbaf248451c5abb58f1030fff"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcc",
"method": "GET",
"path": "\/wp-login.php",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3",
"950502:cms-0"
],
"waf_rule_names": [
"nosqli-3",
"cms-0"
],
"request_line": "GET \/wp-login.php HTTP\/1.1",
"request_sample": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/wp-login.php",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3",
"950502:cms-0"
],
"waf_rule_names": [
"nosqli-3",
"cms-0"
],
"request_line": "GET \/wp-login.php HTTP\/1.1",
"request_sample": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcc",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "636d965dc78e2d29bc9533b44a4e19a8d2062765",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-login.php",
"request_line": "GET \/wp-login.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcc",
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-login.php",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-login.php",
"request_line": "GET \/wp-login.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-login.php",
"evidence_snippet": "GET \/wp-login.php HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcc",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"950502:cms-0",
"http_probe_wp_login",
"http_sensitive_path",
"http_wp_scan",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7001 · (tentative d'exploit) · → /admin/login
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/login UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/admin/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/admin/login
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
ET Magento admin
ES admin GET
Probe /admin/login
ActiveMQ console
Ligne de requête
GET /admin/login HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /admin/login HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Acce
Requête brute (extrait)
GET /admin/login HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "d0bef7aab90ad565ac37faefc12b97956b3bb668",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 163,
"payload_entropy": 5.099573622708589,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 56,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 56,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "f8431793c8516620c3b22f9b6585348254057c67",
"event_fingerprint": "7cba8887f526df17d831be2cacfd57203854be02",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0324",
"pat-0854",
"pat-0341",
"pat-0237",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"ET Magento admin",
"ES admin GET",
"Probe \/admin\/login",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0324",
"pat-0854",
"pat-0341",
"pat-0237",
"pat-0606"
],
"confidence_breakdown": {
"waf": 56,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "a5e3f1a5af6aa4235877da16c1acacc3",
"path_pattern_hash": "801604123651f9ccf70776671d7e3415"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcce",
"method": "GET",
"path": "\/admin\/login",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/admin\/login HTTP\/1.1",
"request_sample": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/admin\/login",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/admin\/login HTTP\/1.1",
"request_sample": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcce",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "deba839a80082a8a35e48e4729f5eeb3bf18a617",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/login",
"request_line": "GET \/admin\/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcce",
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/login",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/login",
"request_line": "GET \/admin\/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/login",
"evidence_snippet": "GET \/admin\/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAcce",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_admin",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:7001 · (tentative d'exploit) · → /manage
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /manage UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
http_admin_panel_probe
net_web_probe
Cible HTTP
GET
/manage
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/manage
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 46
Confiance : Confiance 54 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /manage HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /manage HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Accept: *
Requête brute (extrait)
GET /manage HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "79cd19e6b4e68bc0042458c4ee31f184088a856e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 158,
"payload_entropy": 5.098775053024469,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9996fbccc4d546b173969fca994ffd743000cb71",
"event_fingerprint": "0a4107a499b93795331c419e7994f0b9ecce7438",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "dd539b991a38be6113d3ca06f36a75b1",
"path_pattern_hash": "52b9d3cb0fb4d00873bc4cb360e28c5e"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"method": "GET",
"path": "\/manage",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/manage HTTP\/1.1",
"request_sample": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"evidence": {
"method": "GET",
"path": "\/manage",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/manage HTTP\/1.1",
"request_sample": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46289f9986df1ef1f540ab753e220ffe8d75d27e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/manage",
"request_line": "GET \/manage HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/manage",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/manage",
"request_line": "GET \/manage HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/manage",
"evidence_snippet": "GET \/manage HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"http_admin_panel_probe",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:7001 · (tentative d'exploit) · → /backend
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /backend UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/backend
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/backend
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 46
Confiance : Confiance 54 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /backend HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /backend HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Accept:
Requête brute (extrait)
GET /backend HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "885fbe5cc77de034501ddf9ba78c01e48773cfe8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 159,
"payload_entropy": 5.121482050793265,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6e3c428ba559d6691f86dc42a6e1b89b90a4c6b2",
"event_fingerprint": "188934b0e93e8916831949caf688c5593daa44d8",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "c570dd547a417300b05794dfab3db904",
"path_pattern_hash": "c92b5041713b6818abf4d7b7c254a5ce"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: ",
"method": "GET",
"path": "\/backend",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/backend HTTP\/1.1",
"request_sample": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"evidence": {
"method": "GET",
"path": "\/backend",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/backend HTTP\/1.1",
"request_sample": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b6e1cf6467e887bd1e034f1fc14b0e2e1f9a03c9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend",
"request_line": "GET \/backend HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend",
"request_line": "GET \/backend HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend",
"evidence_snippet": "GET \/backend HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7001 · (tentative d'exploit) · → /admin
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_admin
Cible HTTP
GET
/admin
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/admin
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /admin HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Accept: */
Requête brute (extrait)
GET /admin HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "492924f55ccb86045b8e2142acf33d94581f6e11",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 157,
"payload_entropy": 5.108471916469633,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "7fe7d0d8d27de57aac59d4aa33f60d2867255d08",
"event_fingerprint": "761dc3a76f5dbf2287de197aca4f919fd6de4cfb",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0324",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0324",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "b4b15a2fa3cc20109edb82907baee7a4",
"path_pattern_hash": "84a04c248965d2392b463bd74424c512"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"method": "GET",
"path": "\/admin",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/admin HTTP\/1.1",
"request_sample": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"evidence": {
"method": "GET",
"path": "\/admin",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/admin HTTP\/1.1",
"request_sample": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cdd73c463edd9f353c836169143de719cd7e3fa9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin",
"request_line": "GET \/admin HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin",
"request_line": "GET \/admin HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin",
"evidence_snippet": "GET \/admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_admin",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:7001 · (tentative d'exploit) · → /login
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /login UA Mozilla/5.0 Chrome/120.0.0.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
http_probe_login
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/login
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 46
Confiance : Confiance 54 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /login HTTP/1.1
User-Agent
Mozilla/5.0 Chrome/120.0.0.0
Règles WAF
nosqli-3
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:7001
User-Agent: Mozilla/5.0 Chrome/120.0.0.0
Accept-Encoding: gzip, deflate
Accept: */
Requête brute (extrait)
GET /login HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 Chrome/120.0.0.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "aa8c1a4747d0cb36f6d09d88980e88be33eb999c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 157,
"payload_entropy": 5.089386168556579,
"port_category": "registered",
"org": "VH Global Limited",
"service": "http",
"app_proto": "http",
"asn": 42960,
"country": "HK",
"dst_port": 7001,
"risk_waf": 32,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "15a894090f24e52cbed93e7ddf01e58b65d5f902",
"event_fingerprint": "4d0a43117582b528bf0c642e218cbb1cb0a66b97",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 42960,
"org": "VH Global Limited",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "722a9499a6c9f4b88903235a4402b92d",
"payload_hash": "8bdf664ac695141197dc714458491e8a",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"method": "GET",
"path": "\/login",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a4d824efe07bc46133a245e5511c1f02bb20925",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 Chrome\/120.0.0.0",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 Chrome\/120.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3",
"http_probe_login",
"net_web_probe"
]
}
|