|
|
TCP |
82
|
http
|
web attack
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950513:leak-0
Cible HTTP
GET
/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
82
Chemin / cible
/.git/config
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950513:leak-0
Payload (extrait)
GET /.git/config HTTP/1.1
Host: 62.3.50.33:82
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "git\/config",
"http_ua_hash": "314574ceea90840d3e7fd5894d8612b1eb25ed9c",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 250,
"payload_entropy": 5.410338172059492,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 82,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4a95c8032735b6cd0a99b8ca482a9102fc3bc033",
"event_fingerprint": "b0913f867fb5730b62f789b896c29618db2fd689",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d470b844033a1b1a9cb7ab3c864b89d4",
"payload_hash": "619b8a0fc5088fd0bdca59c82e36a154",
"path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
},
"target_context": {
"dst_port": 82,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (",
"event_signature": "556ce575c03b8e28743663a73cfd01894711fe12",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950513:leak-0",
"http_git_exposure",
"http_probe_git",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
82
|
—
|
Sonde port
|
Faible
|
Faible · 19
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
6443
|
http
|
web attack
|
Élevée
|
Élevé · 71
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950513:leak-0
Cible HTTP
GET
/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6443
Chemin / cible
/.git/config
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (BeOS; U; BeOS BePC; en-US; rv:1.9a1) Gecko/20060702 SeaMonkey/1.5a
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950513:leak-0
Payload (extrait)
GET /.git/config HTTP/1.1
Host: 62.3.50.33:6443
User-Agent: Mozilla/5.0 (BeOS; U; BeOS BePC; en-US; rv:1.9a1) Gecko/20060702 S
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "git\/config",
"http_ua_hash": "a6ef6e45b825f5e304eaa7649ee456be97b6c57e",
"http_host_hash": "351fc269988a63c4812bddbab1cd3e029c6e78ed",
"http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.325100728715585,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 6443,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "64068fe63fdc4b6208d4682978383c5847814b4c",
"event_fingerprint": "7f3056ceef02f10a16e9d2843f482b1dcea5bc02",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "435d9581a2d9c6b08bcdeeb67bcd1df6",
"payload_hash": "3ca93f70ac18840c2ecc00fc9a6360ae",
"path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
},
"target_context": {
"dst_port": 6443,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (BeOS; U; BeOS BePC; en-US; rv:1.9a1) Gecko\/20060702 S",
"event_signature": "5bb0272fb689cfc2b5e969d9fff9525b52fec485",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950513:leak-0",
"http_git_exposure",
"http_probe_git",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
6443
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 28
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��t��7�&K��x���W��N� �+٥g?@ J_� ��Y��Uy�PY���T[�eS� �>��@ &�+�/�,�0̨̩� ��
� � � / 5�
w
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.755235010445864,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 28,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b91f352157911a148ea35ceed4c500df7d82d4e7",
"event_fingerprint": "0cbb552dfc616de8b1fd375401c838d1368484ba",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "dbe0312d12f7e26cb649e55703836128",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 6443,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0002\u0016t\ufffd\ufffd7\ufffd\u0006&K\ufffd\ufffd\u0014x\ufffd\ufffd\ufffdW\ufffd\ufffdN\ufffd\f\u0014\ufffd+\u0665g?@ J_\ufffd\u0000\ufffd\ufffdY\ufffd\ufffdUy\ufffd\u0001PY\ufffd\ufffd\ufffdT[\ufffdeS\ufffd\u001d\ufffd>\ufffd\ufffd@\u001b\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"event_signature": "444387c402030a7a9aa6c1ab6b26b941450142e8",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|