|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.test.local
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.test.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.test.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.test.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.test.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.test.local HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /.env.test.local HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "7037545cd402c24a5b36416f2296a29dfb758ccf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.281944582990226,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "cac767facbafdb542ccb1e1c06a69320b9a09ad5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "469c748a1e85bcccd5ba07502c602bd7",
"path_pattern_hash": "dcacd6523bc1054dd8758815dd403309"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/.env.test.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test.local HTTP\/1.1",
"request_sample": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/.env.test.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test.local HTTP\/1.1",
"request_sample": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c4b0fc7bf829eb30940c762c97efba76af799bd0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test.local",
"request_line": "GET \/.env.test.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test.local",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test.local",
"request_line": "GET \/.env.test.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test.local",
"evidence_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.envrc
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.envrc UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/.envrc
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.envrc
Pourquoi cette classification : Type « config_file_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
pat-0191
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.envrc HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.envrc HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /.envrc HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "envrc",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "498486b1d706a2a0fe94008215d5c4adec1c4f26",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 204,
"payload_entropy": 5.308150555951956,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 54,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "7a375ae32895e271b3686994805b6f633ff48536",
"event_fingerprint": "72615b1f4a1c26f53929f494a8623da9bb0bc848",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 143,
"precision_signals": [
"SIGMA-web-config-leak",
"pat-0191"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"pat-0191"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "bd333ee3c9fbe7fee588cec97c02cf84",
"path_pattern_hash": "7cfe7b2fa6a544f498fff231b84de82d"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/.envrc",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.envrc HTTP\/1.1",
"request_sample": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/.envrc",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.envrc HTTP\/1.1",
"request_sample": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55a188510f78f4fafb20684ec43e6e30d0d09a2d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.envrc",
"request_line": "GET \/.envrc HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.envrc",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"pat-0191"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"pat-0191"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.envrc",
"request_line": "GET \/.envrc HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.envrc",
"evidence_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3002 · (tentative d'exploit) · → /.flaskenv
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.flaskenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/.flaskenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.flaskenv
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.flaskenv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.flaskenv HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.flaskenv HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "flaskenv",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "fee720c7b20ac5bd390dda3bdf53d5a723c8b2c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.321071346695198,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 49,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "7a375ae32895e271b3686994805b6f633ff48536",
"event_fingerprint": "050ffbc04971cfb4bc9da821230379f59fe0f817",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a1cda245edb01ba28cde3c10d391e59a",
"path_pattern_hash": "8a1bc965b661f35ab8ff32c14829976d"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.flaskenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.flaskenv HTTP\/1.1",
"request_sample": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.flaskenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.flaskenv HTTP\/1.1",
"request_sample": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2019b89e72b0b2ab2146fdd637ea495efff7219d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.flaskenv",
"request_line": "GET \/.flaskenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "exploit attempt \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.flaskenv",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.flaskenv",
"request_line": "GET \/.flaskenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.flaskenv",
"evidence_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
3002 · HTTP
|
http
|
probe env
probe env · via HTTP:3002 · (sonde / probe) · → /env
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_probe_env
Cible HTTP
GET
/env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/env
Pourquoi cette classification : Type « probe_env » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — 2 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "ebac263a482818b6e7a922df98cc560bbc808a0a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 201,
"payload_entropy": 5.312945063335998,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 60,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bd1f74375b010ec0ee9daa3f9a3f29feb379ee17",
"event_fingerprint": "a15a6959a90fa69d3a62f2a3e74035da52fb05ef",
"classification_reason": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "fafda11121de0b1e5c0e71ff69773143",
"path_pattern_hash": "1a3ee8c5f071bd935c8a12206727587a"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"method": "GET",
"path": "\/env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env HTTP\/1.1",
"request_sample": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"method": "GET",
"path": "\/env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env HTTP\/1.1",
"request_sample": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64a07897858be76486624c17563ec122889cd828",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env",
"request_line": "GET \/env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "probe env \u00b7 via HTTP:3002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env",
"request_line": "GET \/env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe env \u00b7 via HTTP:3002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env",
"evidence_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_probe_env"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.sample
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.sample UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.sample
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.sample
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.sample HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.sample HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /.env.sample HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "sample",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "095847d45b64fa9778f5b417101046355c7fb8b4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.307204945655281,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "df87cc5d459b815e44d5425f3ebad77bae7f290d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8865640308064e42298c6e883befb4ae",
"path_pattern_hash": "124d2598962516d623c1414e60d74596"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/.env.sample",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.sample HTTP\/1.1",
"request_sample": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/.env.sample",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.sample HTTP\/1.1",
"request_sample": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d739eb64e59638f92e9756ef907ab5048a934df6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.sample",
"request_line": "GET \/.env.sample HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.sample",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.sample",
"request_line": "GET \/.env.sample HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.sample",
"evidence_snippet": "GET \/.env.sample HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.dist
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.dist UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.dist
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.dist
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.dist HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.dist HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.env.dist HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "dist",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "a8dbdb551defc236b9cece3e75d9b78bd8bedf29",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.307643038285906,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "e841abb4aa0c0f41fb01ef2e5f67cf1251272331",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "1ceb798c007d73f197938ddc4085cc92",
"path_pattern_hash": "dca3f24e2bb7c842c1b47abf4a5e3131"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.env.dist",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dist HTTP\/1.1",
"request_sample": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.env.dist",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dist HTTP\/1.1",
"request_sample": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c726dced6b6622f55a6d2203437bba6b09bbfabc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dist",
"request_line": "GET \/.env.dist HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dist",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dist",
"request_line": "GET \/.env.dist HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dist",
"evidence_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.template
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.template UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.template
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.template
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.template HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.template HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Requête brute (extrait)
GET /.env.template HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "template",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "edccaea3bbb1eaacbff6973ad5f703ae60c1ddc1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.298584521429174,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "657bcae0634113a93c6c89b57db77824d921a339",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2078a5998de0d1920de93e80168e291f",
"path_pattern_hash": "6f72c17e203141284a34bb73c6ef5765"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"method": "GET",
"path": "\/.env.template",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.template HTTP\/1.1",
"request_sample": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/.env.template",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.template HTTP\/1.1",
"request_sample": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95195f6e3b46a2d1016ba3d736e9fff4a110cdca",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.template",
"request_line": "GET \/.env.template HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.template",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.template",
"request_line": "GET \/.env.template HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.template",
"evidence_snippet": "GET \/.env.template HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.production.local
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.production.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.production.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.production.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0194
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Probe /.env.production
Ligne de requête
GET /.env.production.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.production.local HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /.env.production.local HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "d3f1365c6401e671ba4f40a870e3ce46645aab05",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 219,
"payload_entropy": 5.29633046038874,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "4031073354884a5e13fd14958c61873e5d42c82a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191",
"pat-0194"
],
"matched_pattern_names": [
"Probe \/.env",
"Probe \/.env.production"
],
"pattern_ids": [
"pat-0191",
"pat-0194"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "847c03eabb7ff552416093d02fc43481",
"path_pattern_hash": "a0a342b9319fca95b9114c90facec319"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"method": "GET",
"path": "\/.env.production.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.production.local HTTP\/1.1",
"request_sample": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"method": "GET",
"path": "\/.env.production.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.production.local HTTP\/1.1",
"request_sample": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8abb9a4f0da13cf8fa9923dfbdf13f8544119c46",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production.local",
"request_line": "GET \/.env.production.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production.local",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0194"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production.local",
"request_line": "GET \/.env.production.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production.local",
"evidence_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.tmp
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.tmp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.tmp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.tmp
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.tmp HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.tmp HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /.env.tmp HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tmp",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "cb6723fb7857c4176b3b5e1f6ae2427cf8334a53",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.31195369342118,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4822f187dcecc874992049b636d874493b5a9331",
"event_fingerprint": "9ebea3d776cc8aef087da00fd3727d901c88116b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "781759ce38a6278a032aa6a34eb512af",
"path_pattern_hash": "31d330f89388715226deefede1ed83eb"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/.env.tmp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.tmp HTTP\/1.1",
"request_sample": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.env.tmp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.tmp HTTP\/1.1",
"request_sample": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48c9fb508d18dd21d9301db372e660255ee282ef",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.tmp",
"request_line": "GET \/.env.tmp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.tmp",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.tmp",
"request_line": "GET \/.env.tmp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.tmp",
"evidence_snippet": "GET \/.env.tmp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.swp
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.swp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.swp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.swp
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.swp HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.swp HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /.env.swp HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "swp",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "55f37e01d36b4eb62c03794ded4913e8977c4123",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.3133638587389145,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4822f187dcecc874992049b636d874493b5a9331",
"event_fingerprint": "0e4847d9948d6b374ade84fce810ea4fe4e6549e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "e29ade7d08dad8afeb4ee8559a574f75",
"path_pattern_hash": "a84d8a774ade6d70daa0e36e81060e15"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/.env.swp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.swp HTTP\/1.1",
"request_sample": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.env.swp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.swp HTTP\/1.1",
"request_sample": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37a540632285fcd20f582fd1b29c5ba23766679a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.swp",
"request_line": "GET \/.env.swp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.swp",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.swp",
"request_line": "GET \/.env.swp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.swp",
"evidence_snippet": "GET \/.env.swp HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env~
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env~ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env~
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env~
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env~ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env~ HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K
Requête brute (extrait)
GET /.env~ HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env~",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "1226c0debb1b75494a73e965e6d8cdcb9b1ead38",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 203,
"payload_entropy": 5.325802742800577,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "20f7440dc5c4c57c0727555067ad4e315ecc71ac",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2fc9ed48c39207e39f44cf6c2cd178c3",
"path_pattern_hash": "cf5f67b633918a8bfbe3f2b4d6e8e9e1"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (K",
"method": "GET",
"path": "\/.env~",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env~ HTTP\/1.1",
"request_sample": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (K",
"evidence": {
"method": "GET",
"path": "\/.env~",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env~ HTTP\/1.1",
"request_sample": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (K",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d95da10ff6e335b2e3f8ffe4088178b09670535",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env~",
"request_line": "GET \/.env~ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (K",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env~",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env~",
"request_line": "GET \/.env~ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env~",
"evidence_snippet": "GET \/.env~ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (K",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.example
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.example UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.example
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.example
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.example HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.example HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /.env.example HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "example",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "080963ef62d711207d0e68706f04d0705ec4d7fa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.308965751877098,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "2ea2b9369eb513d80e1f8c28be87621cef55ac6b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "bda572ed799d2e38fbe1e24384cbee2c",
"path_pattern_hash": "f8bf22cb3ab23601599be7f21fa00aee"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/.env.example",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.example HTTP\/1.1",
"request_sample": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/.env.example",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.example HTTP\/1.1",
"request_sample": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "076b8e972cce641e24840d3a47fcaa4aa2b86de6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.example",
"request_line": "GET \/.env.example HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.example",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.example",
"request_line": "GET \/.env.example HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.example",
"evidence_snippet": "GET \/.env.example HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.backup
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.backup UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.backup
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0192
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Probe /.env.backup
Ligne de requête
GET /.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.backup HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /.env.backup HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "backup",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "0cdfae489c44fe084f54d0d07b1f18ad12bec86e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.324329253098968,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "241a549897b51c760128bfd89d728263f8929612",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0192",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0192",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191",
"pat-0192"
],
"matched_pattern_names": [
"Probe \/.env",
"Probe \/.env.backup"
],
"pattern_ids": [
"pat-0191",
"pat-0192"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "b27b141d6795ef5390fb70143a255dd2",
"path_pattern_hash": "46237bd90c824ac71e080a2ce5957ff9"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/.env.backup",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.backup HTTP\/1.1",
"request_sample": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/.env.backup",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.backup HTTP\/1.1",
"request_sample": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4249527a06c489f61587696b22e4e389d333c995",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.backup",
"request_line": "GET \/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.backup",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0192"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0192"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.backup",
"request_line": "GET \/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.backup",
"evidence_snippet": "GET \/.env.backup HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.save
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.save UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.save
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.save
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.save HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.save HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.env.save HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "save",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "b6acd8fd883f6c293e3cda5fd50434818eb0b3df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.304660977135921,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "00e38ea604b6cbd6f2d5d65484b35b5673dab710",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "911a7c4d055ea379c3093cab034ad468",
"path_pattern_hash": "f8bd9e65b618d21d6e757070964bc6e1"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.env.save",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.save HTTP\/1.1",
"request_sample": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.env.save",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.save HTTP\/1.1",
"request_sample": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb049e833f888f4fe707fec604bc348002fee971",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.save",
"request_line": "GET \/.env.save HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.save",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.save",
"request_line": "GET \/.env.save HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.save",
"evidence_snippet": "GET \/.env.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.old
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.old UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.old
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.old
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.old HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.old HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /.env.old HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "old",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "5c6d2af3e13d17105c8f5fb6187fb5c332303b42",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.3057196520855285,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 70,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "560762ba688979f9bad084870c74a9a10b60e80e",
"event_fingerprint": "f527b7a8d44ade7155fcc1466ec310a97b2f932f",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "4c0c8524d4331f3211bb63409d9dcf62",
"path_pattern_hash": "3807eb1255fb0315f3ffbb94c31e25e0"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/.env.old",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.old HTTP\/1.1",
"request_sample": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.env.old",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.old HTTP\/1.1",
"request_sample": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "24bf8e4e62f1c0e28f933e0112396b2d50e1a9c6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.old",
"request_line": "GET \/.env.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.old",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.old",
"request_line": "GET \/.env.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.old",
"evidence_snippet": "GET \/.env.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.bak
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.bak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.bak
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.bak HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.bak HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /.env.bak HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "bak",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "4a5fcefd2e38e385c845c219c16c9499f238dece",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.314333426409885,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 70,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "560762ba688979f9bad084870c74a9a10b60e80e",
"event_fingerprint": "a6ce9dbf7269c06aa0a828afc1495e3a735dcc13",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ebac6f0fdf20c0d5b7d28a45c9c72a19",
"path_pattern_hash": "e884c8b66a9cc0dbcd8816b9898313a2"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/.env.bak",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.bak HTTP\/1.1",
"request_sample": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.env.bak",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.bak HTTP\/1.1",
"request_sample": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4f794e786286e4f73365b83076f521ccca6a28e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.bak",
"request_line": "GET \/.env.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.bak",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.bak",
"request_line": "GET \/.env.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.bak",
"evidence_snippet": "GET \/.env.bak HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.dev
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.dev UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.dev
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.dev
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.dev HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.dev HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /.env.dev HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "dev",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "a499321530f3e4ddd283e6792cf6d67b1e7cfe88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.312824784800224,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "9067b918fee6549dbc4d30051ddd97b6c4683b8e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "072067b34c989e9da9ac38597cef09fe",
"path_pattern_hash": "ceb221ca10f5b573c09ea91320781e08"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/.env.dev",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dev HTTP\/1.1",
"request_sample": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.env.dev",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dev HTTP\/1.1",
"request_sample": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6cb33497fcae6f1e66a17f2874b21fa870c5605d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dev",
"request_line": "GET \/.env.dev HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dev",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dev",
"request_line": "GET \/.env.dev HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dev",
"evidence_snippet": "GET \/.env.dev HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.prod
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.prod UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.prod
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.prod
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.prod HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.prod HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.env.prod HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "prod",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "dbae5bda5d181ccfbfc6b75e40a8edbe5f27e87d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.311694924958707,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "9f9633985452a0762f2c6ace98138340787b70bf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2e4e1fb1bc2d3f43dec64d3cfbab9fe4",
"path_pattern_hash": "d6acfe32219429bb20e7ee2ee79adb21"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.env.prod",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.prod HTTP\/1.1",
"request_sample": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.env.prod",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.prod HTTP\/1.1",
"request_sample": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff3fa7288321c7c77250d6aa297241bd1ddaf188",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.prod",
"request_line": "GET \/.env.prod HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.prod",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.prod",
"request_line": "GET \/.env.prod HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.prod",
"evidence_snippet": "GET \/.env.prod HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.test
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.test UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.test
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.test
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.test HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.test HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.env.test HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "test",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "4e40a92f813d5ab41a0033a3846a1a977ff1de23",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.294314554671784,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "023e17e29c19532c31f4cbf96079e6c27991de3e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "c3b64cb4932611ef10e04de680eaee5a",
"path_pattern_hash": "d0f775cf96d71b1d76da4d08e462f07a"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.env.test",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test HTTP\/1.1",
"request_sample": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.env.test",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test HTTP\/1.1",
"request_sample": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d826922ccc8fed3c70de93c4d40521159be6ecd3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test",
"request_line": "GET \/.env.test HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test",
"request_line": "GET \/.env.test HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test",
"evidence_snippet": "GET \/.env.test HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.staging
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.staging UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.staging
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.staging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.staging HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.staging HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /.env.staging HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "staging",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "b697ca05984d1bd61ac6a6cd96868703f3417431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.310087285024082,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "a51cba5037eb6d21797508d753c346a51c612807",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "d93f65cf65e9e605824002c820d14048",
"path_pattern_hash": "273c68db2803cfd6e1d27200e5969039"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/.env.staging",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.staging HTTP\/1.1",
"request_sample": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/.env.staging",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.staging HTTP\/1.1",
"request_sample": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92617691246ca250e8c020d1eb21827ab45fbce7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.staging",
"request_line": "GET \/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.staging",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.staging",
"request_line": "GET \/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.staging",
"evidence_snippet": "GET \/.env.staging HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
probe config
probe config · via HTTP:3002 · (sonde / probe) · → /config
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/config
Pourquoi cette classification : Type « probe_config » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — 2 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /config HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /config HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "3383ee1869025a20c1a7d96b3e957f247716cc75",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 204,
"payload_entropy": 5.308971835359012,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 60,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "376e617012afc71503ca79d97f77bd4bac270f79",
"event_fingerprint": "2be81fe78fa91237bbbf918971996ca8d566dfb1",
"classification_reason": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "6e2c8d27114a106dbcb0e12bb7379a20",
"path_pattern_hash": "01d0ea696869632ca69da251f24e240d"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/config",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config HTTP\/1.1",
"request_sample": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/config",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config HTTP\/1.1",
"request_sample": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cd3468afd67c4cee4285aeecbac06cc941cba3d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config",
"request_line": "GET \/config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "probe config \u00b7 via HTTP:3002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/config",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_config \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config",
"request_line": "GET \/config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe config \u00b7 via HTTP:3002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/config",
"evidence_snippet": "GET \/config HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_probe_config"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env
|
Élevée
|
Élevé · 67
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH
Requête brute (extrait)
GET /.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "9ee0d3f55b39072ba6bec6203d26e470be80afdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 202,
"payload_entropy": 5.307096460969247,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1c8df01f2f286be843084864a6746c428ce1f269",
"event_fingerprint": "b5b2af74252db517f6d0b9173618f100d9882982",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "864aba7d52db1566cd5203c3f251c5ce",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"evidence": {
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37582a0d8ba3f2b4d01314297e4b94ff228dac85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.local
|
Élevée
|
Élevé · 67
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0193
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Probe /.env.local
Ligne de requête
GET /.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.local HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /.env.local HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "1bd3d14a0dcd500ff7a77dd7b961ff8960851334",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.293591575351824,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c7bb65e63d5fc623bf60000d31c241bce5417cb9",
"event_fingerprint": "10b03ff052ff5d2bb8dabf0049ef5d6431f87b73",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0193",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0193",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191",
"pat-0193"
],
"matched_pattern_names": [
"Probe \/.env",
"Probe \/.env.local"
],
"pattern_ids": [
"pat-0191",
"pat-0193"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "6d2311714a004ae7bf6dc835b0a337f2",
"path_pattern_hash": "b9c24fc1b97f40588adfd0796c248786"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/.env.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.local HTTP\/1.1",
"request_sample": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/.env.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.local HTTP\/1.1",
"request_sample": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6981b2de8753fe80e952d4cce515c0c74d052223",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.local",
"request_line": "GET \/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.local",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0193"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0193"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.local",
"request_line": "GET \/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.local",
"evidence_snippet": "GET \/.env.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env_local",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.production
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.production UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.production
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0194
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Probe /.env.production
Ligne de requête
GET /.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.production HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /.env.production HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "production",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "9b39fa6529cda07275007291b337879405a04c62",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.310015809226029,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "731d0755c93423be3be1cbcfb344737438385fbf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191",
"pat-0194"
],
"matched_pattern_names": [
"Probe \/.env",
"Probe \/.env.production"
],
"pattern_ids": [
"pat-0191",
"pat-0194"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "b60a8a8ef7df5bb8febc9a53696c1809",
"path_pattern_hash": "a397c8c79032c8a19624fdccf1ae5680"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.production HTTP\/1.1",
"request_sample": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.production HTTP\/1.1",
"request_sample": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "193e5ba7c8e6231281f55f38a88252b05d6ef90e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production",
"request_line": "GET \/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0194"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production",
"request_line": "GET \/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production",
"evidence_snippet": "GET \/.env.production HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3002 · (tentative d'exploit) · → /.env.development
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.development UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.development
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/.env.development
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.development HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.development HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi
Requête brute (extrait)
GET /.env.development HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "development",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "8a4e51701d196d7852353e13bcdd4450138c4d04",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.3060284632831785,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f8a40d7e5d48017a06b116c282a34881523ef34e",
"event_fingerprint": "25f7076780a6421fd4dd5b9bbeb06bb1d0cf3c87",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "9dcb846a807d85eace9ffaab0a547ab0",
"path_pattern_hash": "c0c440edf0616e70222e5cd82887a202"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"method": "GET",
"path": "\/.env.development",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development HTTP\/1.1",
"request_sample": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/.env.development",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development HTTP\/1.1",
"request_sample": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afb79c1b7115fe43aa6cdc4a1b024f37844fddb3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development",
"request_line": "GET \/.env.development HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development",
"request_line": "GET \/.env.development HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development",
"evidence_snippet": "GET \/.env.development HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3002 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3002 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3002
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 53
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET / HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3002
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "ee3abe830eee278c9a8f0ffd85f7b97f39c75219",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.301158358007808,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3002,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 53,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f60454d72596e010ca2bad12a083b15cc6f3c1e9",
"event_fingerprint": "683345535b342510d08745f44603a5fe4cad7ade",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "47e1c6528d79c9436afc74254ca413b1",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3002,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3002\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f0aa85bdab04c385b75cd1bc30fa62f14cc4649",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "exploit attempt \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit)",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3002,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "3002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP
WAF
—
Recommandation
Surveiller
Tags
http_alt_8080
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8080
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "986800c5ad65e75d541a277e48953dacf3f318da",
"event_fingerprint": "5afc6680f618e490dc22cb875ac6d45b5c7d65ea",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945d6c54aac35f31bab6fba8d81332256826a36c",
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_8080",
"http_alt_port",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /docker-compose.yml
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /docker-compose.yml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/docker-compose.yml
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 46%
Confiance classification
46%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 46 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0251
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Probe /docker-compose.yml
Ligne de requête
GET /docker-compose.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.yml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb
Requête brute (extrait)
GET /docker-compose.yml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "284ed5c0f139fefe102f54c41fbd64a2a9a5ffd9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.3508423635261035,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "e7d66252a53e431626956fb55634cb1e21eb19f4",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"confidence": 0.46,
"classification_confidence": 0.46,
"precision_score": 55,
"precision_signals": [
"pat-0251"
],
"kb_rule_ids": [
"pat-0251"
],
"matched_patterns": [
"pat-0251"
],
"matched_pattern_names": [
"Probe \/docker-compose.yml"
],
"pattern_ids": [
"pat-0251"
],
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 46,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "b0dc277e1a063bfd71eeed9c76999b4c",
"path_pattern_hash": "96d32e90d2f8019607590c30e27c0bff"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"method": "GET",
"path": "\/docker-compose.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/docker-compose.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f550b2be94fbab68842da72a7133c694b75cb82",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yml",
"request_line": "GET \/docker-compose.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/docker-compose.yml",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 46 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 46,
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0251"
],
"tags_summary_labels_fr": [
"pat-0251"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yml",
"request_line": "GET \/docker-compose.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/docker-compose.yml",
"evidence_snippet": "GET \/docker-compose.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 46 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:8080 · (tentative d'exploit) · → /docker-compose.yaml
|
Élevée
|
Moyen · 48
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /docker-compose.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/docker-compose.yaml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 48
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker-compose.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.yaml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET /docker-compose.yaml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3bbb8fd589a1c6561445293d25ec31c27a2956aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 217,
"payload_entropy": 5.35061167264927,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "fa1add033af6436dde5a5a6f68da0fb1f43ac8c5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "53cb34f180fea16c66305b5e4e802ebe",
"path_pattern_hash": "d91024f4d52a5546d3cddb98775be9d6"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dcf66b67b7ae66a206a7d754abadce4a92887c9e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "exploit attempt \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.yaml",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.yaml",
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /var/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /var/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/var/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/var/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /var/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /var/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /var/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "7f1fb2a1c5b72e520b988cd8c8a970a6662732b5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.337521537084114,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "ac601517ba862ee2a7acf37b8e4e008f034f90a6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "585747dfdada0d3ad87d58dc084e9c43",
"path_pattern_hash": "0d0f9087dce4407a1a8d5052b0a9d1bf"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/var\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/var\/.env HTTP\/1.1",
"request_sample": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/var\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/var\/.env HTTP\/1.1",
"request_sample": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e27075e81dc0152079ed90c07268903a5178fa1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/.env",
"request_line": "GET \/var\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/.env",
"request_line": "GET \/var\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/.env",
"evidence_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /public/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /public/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/public/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/public/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /public/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /public/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /public/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "bc9ca66c038b10c68f8dffc886361c52fc1ac680",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.341905079659404,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "1e7d07ac128ea4184536b5742c44e04c488d81e9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "c74a534a72837fb4f848d3c8db146e7a",
"path_pattern_hash": "6cf746da949d58c839550a31197db646"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/public\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/public\/.env HTTP\/1.1",
"request_sample": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/public\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/public\/.env HTTP\/1.1",
"request_sample": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "83d573bad7f0181a7dabe948fc5629127a2e2e7c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.env",
"request_line": "GET \/public\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.env",
"request_line": "GET \/public\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.env",
"evidence_snippet": "GET \/public\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /private/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /private/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/private/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/private/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /private/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /private/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /private/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "42ecb4d5f4be7b556e157ee15a288da92dfb0e45",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.331630104630961,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "583061e3276a2414b90dd878ef8d431aa99d526b",
"event_fingerprint": "61216837bfa826f592ca27f2613a9aed505a887c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "3a08942ee7a75aa80b90c8d9e042f345",
"path_pattern_hash": "467844c5e65593cac952660a5e740364"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/private\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env HTTP\/1.1",
"request_sample": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/private\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env HTTP\/1.1",
"request_sample": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef3889e6b4f1394072a9d96b5406ac4d92e0cfe6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/.env",
"request_line": "GET \/private\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/.env",
"request_line": "GET \/private\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env",
"evidence_snippet": "GET \/private\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_private",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /client/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /client/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/client/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/client/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /client/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /client/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /client/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "aa094ac9b0963fceefe47f51ee0dc734bd299416",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.313343645299146,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "89aea4599506556204da24617ea657ef43afe161",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "4c381a47a151a97c24c76cbe8c3fabd5",
"path_pattern_hash": "e9186ae330a383b32843f25c5a42904b"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/client\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/client\/.env HTTP\/1.1",
"request_sample": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/client\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/client\/.env HTTP\/1.1",
"request_sample": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd64400bb7a8ff8389b62fb746dfdd222efe8fe9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/client\/.env",
"request_line": "GET \/client\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/client\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/client\/.env",
"request_line": "GET \/client\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/client\/.env",
"evidence_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /web/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /web/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/web/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/web/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /web/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /web/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /web/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "47bcdedb3b954688023f733564a003e944c34a32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.338392628463158,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "3a2c2d52229b5e64ae0ddfd2f3b7221a29e30d4c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "9071ab314a22170b4fa21d78caf7ae43",
"path_pattern_hash": "d80a28198e7c3b2ce080248f274b9024"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/web\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/web\/.env HTTP\/1.1",
"request_sample": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/web\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/web\/.env HTTP\/1.1",
"request_sample": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5152526801e7bd76ece63d17a172b610470ef5d4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/web\/.env",
"request_line": "GET \/web\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/web\/.env",
"request_line": "GET \/web\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/.env",
"evidence_snippet": "GET \/web\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /server/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /server/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/server/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/server/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /server/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "394e130162f84b369da768999af4d972a2c7e141",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.328120917199431,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "5b3a46e525681b7fc1ba06e11a456d3d3eb43b6d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "156886a5db26755dd21bea6e5db3d0e6",
"path_pattern_hash": "54554b038eab677020ee0c0c2a53bac1"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/server\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env HTTP\/1.1",
"request_sample": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/server\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env HTTP\/1.1",
"request_sample": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71401c7e1c4df4b5587bf3e8483035a4943fc476",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env",
"request_line": "GET \/server\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env",
"request_line": "GET \/server\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env",
"evidence_snippet": "GET \/server\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /frontend/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/frontend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Requête brute (extrait)
GET /frontend/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "77987435bb3ae079ceddf1be0ca83f10bd79e60f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.331228858206629,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "a54ea076de2f4a10a765728941989a9ce7381c5b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "5f60c5d4c8b20a7ba6f2958389e1f3e7",
"path_pattern_hash": "2eb92b74c9200f7bfafce81d1b6d362c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c82a574b23fe5cceedad85fc20bddbcf43ea0673",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env",
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env",
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env",
"evidence_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /api/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/api/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
k8s-api
Payload (extrait)
GET /api/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /api/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "f5b7d21cf92d5caca6cd906725e72730e31bc18c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.326120976183159,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "b021969a0e9cae658eb4366337e4c26db33befe4",
"event_fingerprint": "f7659ffe439728397576a7d942ab74f4d5dbd568",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a433e0ee13b4d44a0d550ab27bb58944",
"path_pattern_hash": "3c658e3b68f996f41891a76e1d05a9a5"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b282215f6f898bacb55b6cbf2c3ee79a40269772",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"http_backup_file_scan",
"http_probe_api",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /backend/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/backend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /backend/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "43427b722c17a9a0bc6fc425a8ca9501d2c985f0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.338743259742025,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "3caec1761426e1010ad0e39e7e8d717b722cb73a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a9c22807b012e64da48d35284b81c459",
"path_pattern_hash": "1ffd9afa4ff51d558fbb13c458726c9c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env HTTP\/1.1",
"request_sample": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env HTTP\/1.1",
"request_sample": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70bc379e91e0c91373c7f4cd6649540d12a01b12",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env",
"request_line": "GET \/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env",
"request_line": "GET \/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env",
"evidence_snippet": "GET \/backend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /config/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /config/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/config/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/config/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /config/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /config/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "867074af7203ec5cf6b039823237b28edf1066aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.3336151584591605,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "d3a2741fecbed5d8888c020a1eaf264349463f84",
"event_fingerprint": "b02fb81f15a28a6d955bb07f3e8083213f4b2054",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "98c12565a79d5fc04d27ba0d19c6e728",
"path_pattern_hash": "2aaa158af561315bc9004215c1f06852"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/config\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env HTTP\/1.1",
"request_sample": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/config\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env HTTP\/1.1",
"request_sample": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "133eae78e398749ec6dface06db30f5120d3e4ae",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/.env",
"request_line": "GET \/config\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/.env",
"request_line": "GET \/config\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env",
"evidence_snippet": "GET \/config\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_config",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /app/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/app/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /app/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /app/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "628b9cb47d9f8d6e8fddc1b7d3cebf1133d17f4f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.329707748373256,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "d285dd69a43e6da5bdcf26ae9ce71ad7024d9712",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "021d6f5136c946f79e0d4dd90b996856",
"path_pattern_hash": "6215588c522bb159cbcefac1cb9fb1de"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/app\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/app\/.env HTTP\/1.1",
"request_sample": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/app\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/app\/.env HTTP\/1.1",
"request_sample": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c2aeea2b8590a8ef05237831064b90750639a27",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.env",
"request_line": "GET \/app\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.env",
"request_line": "GET \/app\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.env",
"evidence_snippet": "GET \/app\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /src/.env
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/src/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /src/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "0c533120cce5f9ceabf0223e76a6dc86fc19a74f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.328535054585944,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "192a4aa9c807ebe0c927b3c25d6a880a130c2bd0",
"event_fingerprint": "483c978fcfe94018bfabd290f6455dd42b89cecc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "41796459314175d785e639889bd07eb0",
"path_pattern_hash": "1be4509071ea53617b7e83d68c291bb4"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/src\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env HTTP\/1.1",
"request_sample": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/src\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env HTTP\/1.1",
"request_sample": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72e331d0a2f5d2c664bfb7f1253293e22368711d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env",
"request_line": "GET \/src\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env",
"request_line": "GET \/src\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env",
"evidence_snippet": "GET \/src\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /env.json
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /env.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/env.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/env.json
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 46%
Confiance classification
46%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 46 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0254
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Probe /env.js
Ligne de requête
GET /env.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /env.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /env.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "2f4402571337da5058699f0cd54fddbd3fc59e3a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.342406398930274,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "818cf3ee73679bb25eb3a8049a67e632f885af1a",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"confidence": 0.46,
"classification_confidence": 0.46,
"precision_score": 55,
"precision_signals": [
"pat-0254"
],
"kb_rule_ids": [
"pat-0254"
],
"matched_patterns": [
"pat-0254"
],
"matched_pattern_names": [
"Probe \/env.js"
],
"pattern_ids": [
"pat-0254"
],
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 46,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "fccba68a40ab193ec893e85165428759",
"path_pattern_hash": "7501c09095d2ee8d9c0f3775ef7c93ef"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/env.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env.json HTTP\/1.1",
"request_sample": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/env.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env.json HTTP\/1.1",
"request_sample": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c4061aa7600f908c2dcb78ab5e3d533fb0188203",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env.json",
"request_line": "GET \/env.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 46 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 46,
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0254"
],
"tags_summary_labels_fr": [
"pat-0254"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env.json",
"request_line": "GET \/env.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env.json",
"evidence_snippet": "GET \/env.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 46 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
probe env
probe env · via HTTP:8080 · (sonde / probe) · → /env
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_probe_env
net_web_probe
Cible HTTP
GET
/env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/env
Pourquoi cette classification : Type « probe_env » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "ebac263a482818b6e7a922df98cc560bbc808a0a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 201,
"payload_entropy": 5.33547901862446,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "914866e0f2c40ddd8dc77bab4399786901af95ed",
"event_fingerprint": "1d5063b9edf49b639cf50690a591ccf33fee2299",
"classification_reason": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "32f157381643579d2b0d8f2a4da940a9",
"path_pattern_hash": "1a3ee8c5f071bd935c8a12206727587a"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"method": "GET",
"path": "\/env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env HTTP\/1.1",
"request_sample": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"method": "GET",
"path": "\/env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env HTTP\/1.1",
"request_sample": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3fd00db1b0fdd0a86bc1d37ebd5164bd0ce1bdd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env",
"request_line": "GET \/env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "probe env \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_env \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env",
"request_line": "GET \/env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe env \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env",
"evidence_snippet": "GET \/env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_probe_env",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Scan vulnérabilités
scanner vuln · via HTTP:8080 · (sonde / probe) · → /env.js
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /env.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/env.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/env.js
Pourquoi cette classification : Type « scanner_vuln » (signaux protocolaires) · confiance 46%
Confiance classification
46%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 46 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0254
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Probe /env.js
Ligne de requête
GET /env.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /env.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /env.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "fd6ac8a28596d70c381f3264e18c90d328ca820b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 204,
"payload_entropy": 5.348868725003214,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "91c769c5b1dd119343cf71da827282c9661a6e19",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"confidence": 0.46,
"classification_confidence": 0.46,
"precision_score": 55,
"precision_signals": [
"pat-0254"
],
"kb_rule_ids": [
"pat-0254"
],
"matched_patterns": [
"pat-0254"
],
"matched_pattern_names": [
"Probe \/env.js"
],
"pattern_ids": [
"pat-0254"
],
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"classification_parent": "vuln_scanner",
"service_name": "http",
"risk_confidence_factor": 46,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "007c28f5e2d657816453e2c434d9953a",
"path_pattern_hash": "e31c80b0fb8251ad89f61b405be7ec35"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/env.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env.js HTTP\/1.1",
"request_sample": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/env.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/env.js HTTP\/1.1",
"request_sample": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b6a8370b34104e0fcec010dc4ae5b7d35919696",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env.js",
"request_line": "GET \/env.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env.js",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 46 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 46,
"confidence_breakdown": {
"waf": 60,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0254"
],
"tags_summary_labels_fr": [
"pat-0254"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/env.js",
"request_line": "GET \/env.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "scanner vuln \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/env.js",
"evidence_snippet": "GET \/env.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 46 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:8080 · (tentative d'exploit) · → /.flaskenv
|
Élevée
|
Moyen · 48
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.flaskenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/.flaskenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/.flaskenv
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 48
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.flaskenv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.flaskenv HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.flaskenv HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "flaskenv",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "fee720c7b20ac5bd390dda3bdf53d5a723c8b2c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.342952143859356,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "0127cf92034a3d7b4d5365f38ec75d7daa4460b6",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "654dcabf63f745b8cd6adf799b606bc0",
"path_pattern_hash": "8a1bc965b661f35ab8ff32c14829976d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.flaskenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.flaskenv HTTP\/1.1",
"request_sample": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.flaskenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.flaskenv HTTP\/1.1",
"request_sample": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8863d7a1227e23a8db3651c96406e8df58c9c58",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.flaskenv",
"request_line": "GET \/.flaskenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "exploit attempt \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.flaskenv",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.flaskenv",
"request_line": "GET \/.flaskenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.flaskenv",
"evidence_snippet": "GET \/.flaskenv HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env.test.local
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.test.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.test.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/.env.test.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.test.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.test.local HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /.env.test.local HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "7037545cd402c24a5b36416f2296a29dfb758ccf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.303209019670888,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8bce59d43959c02d130d416574ffa4b1b35b3c86",
"event_fingerprint": "22eb22145373517af6c664bbce364c327c406358",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "b856910a0f4090a2c8ba38960a6d6080",
"path_pattern_hash": "dcacd6523bc1054dd8758815dd403309"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/.env.test.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test.local HTTP\/1.1",
"request_sample": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/.env.test.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test.local HTTP\/1.1",
"request_sample": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b14ca2814415e9a915843bfcdea14efca75d671",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test.local",
"request_line": "GET \/.env.test.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test.local",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test.local",
"request_line": "GET \/.env.test.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test.local",
"evidence_snippet": "GET \/.env.test.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.envrc
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.envrc UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/.envrc
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/.envrc
Pourquoi cette classification : Type « config_file_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
pat-0191
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.envrc HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.envrc HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /.envrc HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "envrc",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "498486b1d706a2a0fe94008215d5c4adec1c4f26",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 204,
"payload_entropy": 5.330353129544998,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "bf2db95b463cc3679143eb3488f2becc8a8d2b5b",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 143,
"precision_signals": [
"SIGMA-web-config-leak",
"pat-0191"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"pat-0191"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8ed5b030bc7a080d67a742ab35fc4758",
"path_pattern_hash": "7cfe7b2fa6a544f498fff231b84de82d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/.envrc",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.envrc HTTP\/1.1",
"request_sample": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/.envrc",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.envrc HTTP\/1.1",
"request_sample": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ffb4a00619197edb08a60eaeb36788eaf8c4478",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.envrc",
"request_line": "GET \/.envrc HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.envrc",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"pat-0191"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"pat-0191"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.envrc",
"request_line": "GET \/.envrc HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.envrc",
"evidence_snippet": "GET \/.envrc HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env.development.local
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.development.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.development.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/.env.development.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.development.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.development.local HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl
Requête brute (extrait)
GET /.env.development.local HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "44b27fcf42134edd5dc872c2c6f931dc026ceb76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 220,
"payload_entropy": 5.312842457075713,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8bce59d43959c02d130d416574ffa4b1b35b3c86",
"event_fingerprint": "71c1f995c300912325df4f3ecd654e3e2bd285e4",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "1f9b2dfbab97eb315b060ab454028cb6",
"path_pattern_hash": "66b5346fea2c0f881a6004f5150ea85e"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"method": "GET",
"path": "\/.env.development.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development.local HTTP\/1.1",
"request_sample": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"evidence": {
"method": "GET",
"path": "\/.env.development.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development.local HTTP\/1.1",
"request_sample": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e4fa714d36f19f8b93222c3d186eb6edd0ee0ffd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development.local",
"request_line": "GET \/.env.development.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development.local",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development.local",
"request_line": "GET \/.env.development.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development.local",
"evidence_snippet": "GET \/.env.development.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env.production.local
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.production.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.production.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/.env.production.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0194
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Probe /.env.production
Ligne de requête
GET /.env.production.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.production.local HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /.env.production.local HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "d3f1365c6401e671ba4f40a870e3ce46645aab05",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 219,
"payload_entropy": 5.317012309763081,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8bce59d43959c02d130d416574ffa4b1b35b3c86",
"event_fingerprint": "6d28f226dd3d9ff5d2ee16dbf8d71cf82548020d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191",
"pat-0194"
],
"matched_pattern_names": [
"Probe \/.env",
"Probe \/.env.production"
],
"pattern_ids": [
"pat-0191",
"pat-0194"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ca0ece0250d18f1f2cce9b62f3149ae2",
"path_pattern_hash": "a0a342b9319fca95b9114c90facec319"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"method": "GET",
"path": "\/.env.production.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.production.local HTTP\/1.1",
"request_sample": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"method": "GET",
"path": "\/.env.production.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.production.local HTTP\/1.1",
"request_sample": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "034096f2c69ebb14988fffba73208020fc66d406",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production.local",
"request_line": "GET \/.env.production.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production.local",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0194"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0194"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.production.local",
"request_line": "GET \/.env.production.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.production.local",
"evidence_snippet": "GET \/.env.production.local HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env.dist
|
Élevée
|
Élevé · 66
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.dist UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.dist
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/.env.dist
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.dist HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.dist HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /.env.dist HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "dist",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "a8dbdb551defc236b9cece3e75d9b78bd8bedf29",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.329523835450064,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 8080,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8bce59d43959c02d130d416574ffa4b1b35b3c86",
"event_fingerprint": "5f89cbc1e258e682d34eed44a3507db94254629e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "839027f564772e88693244aa759e0a02",
"path_pattern_hash": "dca3f24e2bb7c842c1b47abf4a5e3131"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/.env.dist",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dist HTTP\/1.1",
"request_sample": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/.env.dist",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dist HTTP\/1.1",
"request_sample": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30c9239c3df5a54f81a8223f6b182d8abb5b6114",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dist",
"request_line": "GET \/.env.dist HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dist",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dist",
"request_line": "GET \/.env.dist HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dist",
"evidence_snippet": "GET \/.env.dist HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|