|
|
TCP |
22
|
http
|
web attack
|
Élevée
|
Élevé · 68
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
27
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
22
Chemin / cible
/favicon.ico
Confiance classification
92%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Règles WAF
950318:lfi-14
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33
Connection: keep-alive
sec-ch-ua: "Chromium";v="142", "Not:A-Brand";v="24", "Brave
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "7ee799f61ba7a58c85c8f4083ea329400312b8c6",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": "5058cff649a7ebcff5edfc5aded37c0496ae49e1",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 646,
"payload_entropy": 5.519547354263266,
"port_category": "well_known",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "IN",
"dst_port": 22,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 68,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "736e6172695c2e152de7f2a3b27e4313b764074f",
"event_fingerprint": "c39e885436ce7de766faee7e87f1647dbd378297",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "61b88f0a9f3157393f99888d9f518355",
"payload_hash": "15da3336bc3c8550b8c6087b1277460a",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 22,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.92,
"classification_confidence": 0.92,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nConnection: keep-alive\r\nsec-ch-ua: \"Chromium\";v=\"142\", \"Not:A-Brand\";v=\"24\", \"Brave",
"event_signature": "967aea5ac4ce2cb41c405d34ade6e8e393170156",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22
|
http
|
web attack
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
22
Chemin / cible
/
Confiance classification
89%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Règles WAF
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
Connection: keep-alive
sec-ch-ua: "Chromium";v="142", "Not:A-Brand";v="24", "Brave";v="142"
Meta JSON brut
{
"http_header_count": 15,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7ee799f61ba7a58c85c8f4083ea329400312b8c6",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 603,
"payload_entropy": 5.521368081236172,
"port_category": "well_known",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "IN",
"dst_port": 22,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ec39956ab7d566c5e257218c1f69710d11871a8d",
"event_fingerprint": "76930fc2dab0672f332261f7f10fe4f983ffbdfa",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IN",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "61b88f0a9f3157393f99888d9f518355",
"payload_hash": "c8033812c524fc040fc2d0ae5085219f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 22,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.89,
"classification_confidence": 0.89,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nConnection: keep-alive\r\nsec-ch-ua: \"Chromium\";v=\"142\", \"Not:A-Brand\";v=\"24\", \"Brave\";v=\"142\"\r\n",
"event_signature": "ee94eb5c3c6715fdcdc8c79f1580436cd8795aa5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|