|
|
TCP |
9093 · KAFKA CONTROLLER
|
kafka-controller
|
kafka-controller
kafka-controller · via KAFKA CONTROLLER:9093 · (sonde / probe)
|
Faible
|
Faible · 11
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA-CONTROLLER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9093
Chemin / cible
—
Service
KAFKA CONTROLLER
Payload
sarama����
Pourquoi cette classification : Type « kafka-controller » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 11
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0532
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
sarama����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a",
"emulator_response_len": 47,
"bytes_in": 25,
"payload_entropy": 2.8048894517332403,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka-controller",
"app_proto": "kafka-controller",
"asn": 14061,
"country": "US",
"dst_port": 9093,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 11,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "85c2d1f222966dd7c86c765c2ee412a825f828b9",
"event_fingerprint": "5e86e7ef7317f197e3a55fdab091d110850a32e6",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0532"
],
"classification_reason": "Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 11
},
"service_name": "kafka-controller",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0a78e71a9f8645a1d79789b4c4da099d",
"path_pattern_hash": "bdd83a591b819eaddba50799a531ed9f"
},
"target_context": {
"dst_port": 9093,
"service": "kafka-controller",
"service_name": "kafka-controller",
"risk_score": 11
},
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb308e3ac888c2a3d1e23a9349a345b01021ae2e",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka-controller \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 11
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 11,
"risk_label": "Faible",
"service_name": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER",
"dst_port": 9093,
"protocol_emulated": true,
"tags_summary": [
"pat-0532"
],
"tags_summary_labels_fr": [
"pat-0532"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-controller",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"attack_vector": "kafka-controller \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_controller",
"service_banner": "honeypot-kafka-controller",
"service_os": "linux",
"dst_port": "9093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9093 · KAFKA CONTROLLER
|
kafka-controller
|
solr probe
solr probe · via KAFKA CONTROLLER:9093 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
Émulateur
KAFKA-CONTROLLER
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
solr_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9093
Chemin / cible
—
Service
KAFKA CONTROLLER
Payload
GET /solr/admin/info/system HTTP/1.1 Host: 62.3.50.33:9093 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « solr_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Faible
· 38
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Console admin Apache Solr
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:9093
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a",
"emulator_response_len": 47,
"bytes_in": 114,
"payload_entropy": 4.9474348362472735,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka-controller",
"app_proto": "kafka-controller",
"asn": 14061,
"country": "US",
"dst_port": 9093,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 32,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ae81f554e5170edb685f12a3c79583bc80b2ce16",
"event_fingerprint": "5e86e7ef7317f197e3a55fdab091d110850a32e6",
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 93,
"precision_signals": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"kb_rule_ids": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "kafka-controller",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f8688fb4b3fa680ba144f0747ec953c7",
"path_pattern_hash": "1532cf2abc57fe877a1cb39330f129c4"
},
"target_context": {
"dst_port": 9093,
"service": "kafka-controller",
"service_name": "kafka-controller",
"risk_score": 38
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"monitoring_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5bfe54de55a59b2c465e36d5151fa06752e571db",
"protocol_details": {
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "solr probe \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER",
"dst_port": 9093,
"protocol_emulated": true,
"tags_summary": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Console admin Apache Solr",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-controller",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"attack_vector": "solr probe \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_controller",
"service_banner": "honeypot-kafka-controller",
"service_os": "linux",
"dst_port": "9093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"solr_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9093 · KAFKA CONTROLLER
|
kafka-controller
|
modbus probe
modbus probe · via KAFKA CONTROLLER:9093 · (sonde / probe)
|
Faible
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA-CONTROLLER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9093
Chemin / cible
—
Service
KAFKA CONTROLLER
Payload
sarama����
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 33
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0357
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Modbus TCP header
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
sarama����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a",
"emulator_response_len": 47,
"bytes_in": 25,
"payload_entropy": 2.6115107774877746,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka-controller",
"app_proto": "kafka-controller",
"asn": 14061,
"country": "US",
"dst_port": 9093,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 33,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "85c2d1f222966dd7c86c765c2ee412a825f828b9",
"event_fingerprint": "5e86e7ef7317f197e3a55fdab091d110850a32e6",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0357"
],
"kb_rule_ids": [
"pat-0357"
],
"matched_patterns": [
"pat-0357",
"pat-0554"
],
"matched_pattern_names": [
"Modbus TCP header",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0357",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "kafka-controller",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cdfc5882fd0fe4e2dd0a38e19224d60b",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 9093,
"service": "kafka-controller",
"service_name": "kafka-controller",
"risk_score": 33
},
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4c5d93177ec720c68e3081eb2ce599bd390e4db5",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "modbus probe \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER",
"dst_port": 9093,
"protocol_emulated": true,
"tags_summary": [
"pat-0357"
],
"tags_summary_labels_fr": [
"pat-0357"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-controller",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"attack_vector": "modbus probe \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_controller",
"service_banner": "honeypot-kafka-controller",
"service_os": "linux",
"dst_port": "9093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
9093 · KAFKA CONTROLLER
|
kafka-controller
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via KAFKA CONTROLLER:9093 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA-CONTROLLER
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_sap_diag_probe
sap_diag_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9093
Chemin / cible
—
Service
KAFKA CONTROLLER
Payload
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:9093 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:9093
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a",
"emulator_response_len": 47,
"bytes_in": 116,
"payload_entropy": 5.254863707451544,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka-controller",
"app_proto": "kafka-controller",
"asn": 14061,
"country": "US",
"dst_port": 9093,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "448da75cf13877d668bfc936d2b247e1bd37d4c7",
"event_fingerprint": "2798ab460a6f8da68adfe0f0c2e9afb5436993c1",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "kafka-controller",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "500c5bb0b56e84701616503ff25bf573",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 9093,
"service": "kafka-controller",
"service_name": "kafka-controller",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2459143d2cf55b7212042ac0fca03a6394ac496b",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER",
"dst_port": 9093,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-controller",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9093\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_controller",
"service_banner": "honeypot-kafka-controller",
"service_os": "linux",
"dst_port": "9093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_sap_diag_probe",
"sap_diag_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8983 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8983 · (tentative d'exploit) · → /solr/admin/cores
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/cores UA Go-http-client/1.1
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/solr/admin/cores
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8983
Chemin / cible
/solr/admin/cores
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:8983
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "f6c3bc255d867495897cae2961e69a919c989cc2",
"http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.090975344957819,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 8983,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "991cc2da4d3e55cdab1a4954d8ba78801fd84849",
"event_fingerprint": "c24197e48da4de9c34f25646e3751f151de32953",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a2ae0a0b6af09542e1e326b861f60bc2",
"path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
},
"target_context": {
"dst_port": 8983,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n",
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "436518febaa20f73341ad8c57a04127001e052d6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8983,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:8983 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"target_port_label": "8983 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8983,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8983,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8983 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8983 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8983"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-diag"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8983 · SAP Diag
|
sap-diag
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:8983 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_sap_diag_probe
sap_diag_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8983
Chemin / cible
—
Service
SAP Diag
Payload
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:8983 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:8983
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"bytes_in": 116,
"payload_entropy": 5.272105086761888,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 14061,
"country": "US",
"dst_port": 8983,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 48,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "049b5824af3f91d282f4abae71c87381fca606cf",
"event_fingerprint": "5dfb1a57e49c5117bfaf6cb92c78289c5a3d9538",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "111be3c389161e05c5223b359302c7cb",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 8983,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6dd32e35d54c0877a8f1dbab3374b600bb254b8c",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 8983,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:8983 \u00b7 (sonde \/ probe)",
"target_port_label": "8983 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 8983,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 8983,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:8983 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8983 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "8983"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_sap_diag_probe",
"sap_diag_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8983 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8983 · (tentative d'exploit) · → /solr/admin/info/system
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/info/system UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_solr
Cible HTTP
GET
/solr/admin/info/system
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8983
Chemin / cible
/solr/admin/info/system
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/info/system HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:8983
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "f6c3bc255d867495897cae2961e69a919c989cc2",
"http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 4.964978695896397,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 8983,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "beae9a5e0e137473af234703788e2b1105fcdffc",
"event_fingerprint": "edc246dd7ab371bf90a35f144f669ca16a92469f",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "95f160575cfefe83631cbdbe8dbdcb72",
"path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
},
"target_context": {
"dst_port": 8983,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cdc202732634a3878bedc46b9ba1d53271f9eb06",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8983,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:8983 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"target_port_label": "8983 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8983,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8983,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8983 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:8983\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8983 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8983"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-diag"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
9203 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:9203 · (tentative d'exploit) · → /solr/admin/info/system
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/info/system UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_solr
Cible HTTP
GET
/solr/admin/info/system
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9203
Chemin / cible
/solr/admin/info/system
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/info/system HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:9203
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e92b718328952eaf8116e79ea0ca2c3046d5ed14",
"http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 4.9474348362472735,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 9203,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e9f4f3ee3798e87a467500363016595fb0b25070",
"event_fingerprint": "bed1555fa25368fe7cc9f7063d5a21139709223f",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "ed23134a4b9ea8e81296c8cad5883146",
"path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
},
"target_context": {
"dst_port": 9203,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "968c67a195b614c20400ff97f829ae24a1dc3520",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9203,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:9203 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"target_port_label": "9203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9203,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9203,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9203 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
9203 · SAP Diag
|
sap-diag
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:9203 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_sap_diag_probe
sap_diag_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9203
Chemin / cible
—
Service
SAP Diag
Payload
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:9203 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:9203
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"bytes_in": 116,
"payload_entropy": 5.254863707451544,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 14061,
"country": "US",
"dst_port": 9203,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 48,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f656347dccc648f547afd6cc88ce0eac20d690cb",
"event_fingerprint": "96a92f17c0dbb39b5401f61afaee979d2b5452d3",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f9306833eef838e2d27ee71479cb53b",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 9203,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "176343a1c16eec76d50ceeac71ccb30ed8414e20",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 9203,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:9203 \u00b7 (sonde \/ probe)",
"target_port_label": "9203 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 9203,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 9203,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:9203 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9203 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "9203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-diag"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_sap_diag_probe",
"sap_diag_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9203 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:9203 · (tentative d'exploit) · → /solr/admin/cores
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/cores UA Go-http-client/1.1
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/solr/admin/cores
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9203
Chemin / cible
/solr/admin/cores
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:9203
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e92b718328952eaf8116e79ea0ca2c3046d5ed14",
"http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.075590729573204,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 9203,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "5527ea3f72c3e43e2f2d621a237b8d229ced6492",
"event_fingerprint": "19ce2b145d0a9db17fdddb0764da76c442152d1e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a62e190f16ff12dbe9a66535aca7d9eb",
"path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
},
"target_context": {
"dst_port": 9203,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n",
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f9a5f065f78c6479f595522498cb7716da4bb43",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9203,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:9203 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"target_port_label": "9203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9203,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9203,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9203 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9203\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-diag"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
29092 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:29092 · (tentative d'exploit) · → /v2/_catalog
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /v2/_catalog UA Go-http-client/1.1
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
http_probe_registry
http_ua_suspicious
Cible HTTP
GET
/v2/_catalog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
29092
Chemin / cible
/v2/_catalog
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 50
Confiance : Confiance 59 % — 2 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /v2/_catalog HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:29092
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "8ab58e916690f18287f0bf2fe745b0cb6e241d5b",
"http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 4.9447326045240905,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 29092,
"risk_waf": 64,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 50,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f064b73b52aa74e94e6e25334b2c066a6b7707ab",
"event_fingerprint": "bd3cdac8d668f612ae83c8f90bddb7e305e21541",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "49261b45a2044afe2b005227cffd745d",
"path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
},
"target_context": {
"dst_port": 29092,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8fd290ad351b12f9b7d5e78eb917557ca3ae5b70",
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 29092,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via HTTP:29092 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"target_port_label": "29092 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 29092,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 29092,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:29092 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:29092\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "29092 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "29092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"http_probe_registry",
"http_ua_suspicious"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Sonde PostgreSQL
postgres probe · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
net_mssql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
� �+���+g�)�b�s� O1D ���\V�a �R���ρ������r,K����Nl)�T�cܤ &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �+���+g�)�b�s� O1D ���\V�a �R���ρ������r,K����Nl)�T�cܤ &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �+���+g�)�b�s� O1D ���\V�a �R���ρ������r,K����Nl)�T�cܤ &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ���V��k�NB�?��y`d��O�� �� R
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 243,
"payload_entropy": 5.761797571793094,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "37051d253c792a703ef86a951fdecd81bbfe50e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a47e31c51833e040f5b3d2b3a30a1cc8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u0006\ufffd+\u0015g\ufffd)\ufffdb\ufffd\u0002\u0019s\u038b\u0002\ufffd\u001cO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\u001b\ufffd\u000f\ufffd\ufffdr,K\ufffd\ufffd\u0004\ufffd\ufffdNl)\ufffdT\ufffdc\u0724\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u0006\ufffd+\u0015g\ufffd)\ufffdb\ufffd\u0002\u0019s\u038b\u0002\ufffd\u001cO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\u001b\ufffd\u000f\ufffd\ufffdr,K\ufffd\ufffd\u0004\ufffd\ufffdNl)\ufffdT\ufffdc\u0724\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdV\ufffd\ufffdk\u000e\ufffd\u0002\u0015NB\ufffd?\ufffd\ufffdy`d\ufffd\ufffdO\ufffd\ufffd\u000b\ufffd\ufffd\u001cR\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u0006\ufffd+\u0015g\ufffd)\ufffdb\ufffd\u0002\u0019s\u038b\u0002\ufffd\u001cO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\u001b\ufffd\u000f\ufffd\ufffdr,K\ufffd\ufffd\u0004\ufffd\ufffdNl)\ufffdT\ufffdc\u0724\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab3dfe65699871c38174e70b9d5bd305901ab8f0",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u0006\ufffd+\u0015g\ufffd)\ufffdb\ufffd\u0002\u0019s\u038b\u0002\ufffd\u001cO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\u001b\ufffd\u000f\ufffd\ufffdr,K\ufffd\ufffd\u0004\ufffd\ufffdNl)\ufffdT\ufffdc\u0724\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffd\ufffd+g\ufffd)\ufffdb\ufffds\u038b\ufffdO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdr,K\ufffd\ufffd\ufffd\ufffdNl)\ufffdT\ufffdc\u0724&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\u0006\ufffd+\u0015g\ufffd)\ufffdb\ufffd\u0002\u0019s\u038b\u0002\ufffd\u001cO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\u001b\ufffd\u000f\ufffd\ufffdr,K\ufffd\ufffd\u0004\ufffd\ufffdNl)\ufffdT\ufffdc\u0724\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffd\ufffd+g\ufffd)\ufffdb\ufffds\u038b\ufffdO1D\t\ufffd\ufffd\ufffd\\V\ufffda \ufffdR\ufffd\ufffd\ufffd\u03c1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdr,K\ufffd\ufffd\ufffd\ufffdNl)\ufffdT\ufffdc\u0724&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"net_mssql_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
mssql probe
mssql probe · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
net_mssql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
$ �j5�7�Ņ&bc ���!�bUP �^=9� �;&ى�qp�*?��?ɦ=�� �j�$!?�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « mssql_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
$ �j5�7�Ņ&bc ���!�bUP
�^=9� �;&ى�qp�*?��?ɦ=�� �j�$!?�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
$ �j5�7�Ņ&bc ���!�bUP �^=9� �;&ى�qp�*?��?ɦ=�� �j�$!?�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � � # * ( + -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 297,
"payload_entropy": 5.73661283644846,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 32,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "37051d253c792a703ef86a951fdecd81bbfe50e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 32
},
"service_name": "mssql",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "33e6cad9d350bbe0fe05d475f1ed687a",
"path_pattern_hash": "6d4ca317e1154f7afb07772c79279a04"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffdj5\u0016\ufffd7\ufffd\u0145&bc \u0015\u000b\ufffd\ufffd\ufffd!\ufffdbU\bP\r\u001f\ufffd^=9\u000f\ufffd \ufffd;&\u0649\u0016\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\u000b\u0007\ufffdj\ufffd$!\u0018\u0005?\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffdj5\u0016\ufffd7\ufffd\u0145&bc \u0015\u000b\ufffd\ufffd\ufffd!\ufffdbU\bP\r\u001f\ufffd^=9\u000f\ufffd \ufffd;&\u0649\u0016\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\u000b\u0007\ufffdj\ufffd$!\u0018\u0005?\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffdj5\u0016\ufffd7\ufffd\u0145&bc \u0015\u000b\ufffd\ufffd\ufffd!\ufffdbU\bP\r\u001f\ufffd^=9\u000f\ufffd \ufffd;&\u0649\u0016\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\u000b\u0007\ufffdj\ufffd$!\u0018\u0005?\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2257e144e856840d381ae969f186486e65f85f5",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffdj5\u0016\ufffd7\ufffd\u0145&bc \u0015\u000b\ufffd\ufffd\ufffd!\ufffdbU\bP\r\u001f\ufffd^=9\u000f\ufffd \ufffd;&\u0649\u0016\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\u000b\u0007\ufffdj\ufffd$!\u0018\u0005?\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "$ \ufffdj5\ufffd7\ufffd\u0145&bc \ufffd\ufffd\ufffd!\ufffdbUP\r\ufffd^=9\ufffd \ufffd;&\u0649\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\ufffdj\ufffd$!?\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffdj5\u0016\ufffd7\ufffd\u0145&bc \u0015\u000b\ufffd\ufffd\ufffd!\ufffdbU\bP\r\u001f\ufffd^=9\u000f\ufffd \ufffd;&\u0649\u0016\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\u000b\u0007\ufffdj\ufffd$!\u0018\u0005?\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "$ \ufffdj5\ufffd7\ufffd\u0145&bc \ufffd\ufffd\ufffd!\ufffdbUP\r\ufffd^=9\ufffd \ufffd;&\u0649\ufffdqp\ufffd*?\ufffd\ufffd?\u0266=\ufffd\ufffd\ufffdj\ufffd$!?\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"net_mssql_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Sonde PostgreSQL
postgres probe · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 1b9bb541fa237aff SNI 62.3.50.33
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
net_mssql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
SNI TLS
62.3.50.33
Payload
� ��^*��Z�U] {�=]|_uC��&p ��u�F P�/�+���� �� / 5� �$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��^*��Z�U] {�=]|_uC��&p ��u�F P�/�+���� ��
/ 5�
�$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0
Requête brute (extrait)
� ��^*��Z�U] {�=]|_uC��&p ��u�F P�/�+���� �� / 5� �$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0 G 62.3.50.33 �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 201,
"payload_entropy": 5.004683433237981,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "37051d253c792a703ef86a951fdecd81bbfe50e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9d62eb13c71a164c45b446496a92cc30",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "1b9bb541fa237aff65acf838b154df7f",
"ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_version": "0x0303",
"tls_cipher_count": 40,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_ja4": "t13d0140_c79c1c2c7c3c_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 40,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd^*\ufffd\ufffdZ\ufffdU\u0011]\u0003\u001f{\ufffd=\u0015]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdF\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd^*\ufffd\ufffdZ\ufffdU\u0011]\u0003\u001f{\ufffd=\u0015]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdF\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000\u0000G\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd^*\ufffd\ufffdZ\ufffdU\u0011]\u0003\u001f{\ufffd=\u0015]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdF\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "344766f5af886888922c774edc39266bf4350d9f",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd^*\ufffd\ufffdZ\ufffdU\u0011]\u0003\u001f{\ufffd=\u0015]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdF\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"tls_ja3": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_sni": "62.3.50.33",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\ufffd\ufffd\ufffd^*\ufffd\ufffdZ\ufffdU]{\ufffd=]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdFP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0",
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd^*\ufffd\ufffdZ\ufffdU\u0011]\u0003\u001f{\ufffd=\u0015]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdF\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"tls_ja3": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_sni": "62.3.50.33",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd^*\ufffd\ufffdZ\ufffdU]{\ufffd=]|_uC\ufffd\ufffd&p \ufffd\ufffdu\ufffdFP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"net_mssql_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
imap bruteforce
imap bruteforce · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
imap_probe
mssql_emulated
mssql_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Rafale d'authentification SSH · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 62.3.50.33:1433
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 113,
"payload_entropy": 4.903280269962342,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25
},
"risk_score": 41,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b402bb28a94d9f92c97cf32cb6ac820f40ef699f",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e4f5bb46982eb86cb72862d1a5221e96",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 41
},
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ce188f4e4888bbebfcfca8a5199f2764e266774",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "imap bruteforce \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Rafale d'authentification SSH \u00b7 confiance 95%",
"classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "imap bruteforce \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"imap_probe",
"mssql_emulated",
"mssql_payload",
"net_bruteforce_burst",
"net_mssql_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
/ ! " & � �
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Faible
· 35
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Mumble ping
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
/ ! " & � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 47,
"payload_entropy": 2.4483845318297544,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "584dc8ab43572550a5af46f03637ac724e8c86c3",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0768",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Mumble ping",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0768",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ac2c96b2eda06262c797439e5301e3b7",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49193ae207fe9f920f6d1ebe575d86e8403c8fa9",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\/ !\"&\ufffd\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0519",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/ !\"&\ufffd\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_mssql_tds"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
imap bruteforce
imap bruteforce · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
imap_probe
mssql_emulated
mssql_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 62.3.50.33:1433
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 113,
"payload_entropy": 4.903280269962342,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25
},
"risk_score": 41,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a5fede9c6ff676e6247103daeda430e40579043",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e4f5bb46982eb86cb72862d1a5221e96",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 41
},
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "708be9fd288506a9226f13d781bebe8bbdc9f303",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "imap bruteforce \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "imap bruteforce \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"imap_probe",
"mssql_emulated",
"mssql_payload",
"net_mssql_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
Sonde PostgreSQL
postgres probe · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
net_mssql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
� ���N� {<�ph���1PS��@H�ת��H ��Q����g�f��t�l���&^�˾�f�ʄ &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���N� {<�ph���1PS��@H�ת��H ��Q����g�f��t�l���&^�˾�f�ʄ &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ���N� {<�ph���1PS��@H�ת��H ��Q����g�f��t�l���&^�˾�f�ʄ &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ � r�����N' �c�%�����)�F*y��M
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 243,
"payload_entropy": 5.850547640813652,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "37051d253c792a703ef86a951fdecd81bbfe50e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ec3cec830a8f72130796734ead9cb8a1",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdN\ufffd\u001c{<\ufffdp\u0001h\u001b\ufffd\u0011\ufffd\ufffd1PS\ufffd\u000e\ufffd@H\ufffd\u05ea\ufffd\ufffdH\u000e \ufffd\ufffdQ\ufffd\ufffd\ufffd\u001a\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\u0003\ufffd&^\ufffd\u02fe\ufffd\u0016f\u000e\ufffd\u0284\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdN\ufffd\u001c{<\ufffdp\u0001h\u001b\ufffd\u0011\ufffd\ufffd1PS\ufffd\u000e\ufffd@H\ufffd\u05ea\ufffd\ufffdH\u000e \ufffd\ufffdQ\ufffd\ufffd\ufffd\u001a\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\u0003\ufffd&^\ufffd\u02fe\ufffd\u0016f\u000e\ufffd\u0284\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001dr\ufffd\ufffd\ufffd\ufffd\ufffdN\u000f'\u001c\u000e\ufffdc\u001a\ufffd%\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffdF\u0012*y\ufffd\ufffdM",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdN\ufffd\u001c{<\ufffdp\u0001h\u001b\ufffd\u0011\ufffd\ufffd1PS\ufffd\u000e\ufffd@H\ufffd\u05ea\ufffd\ufffdH\u000e \ufffd\ufffdQ\ufffd\ufffd\ufffd\u001a\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\u0003\ufffd&^\ufffd\u02fe\ufffd\u0016f\u000e\ufffd\u0284\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0175e95e5fa8165064b7151568067f9e1d5498b2",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdN\ufffd\u001c{<\ufffdp\u0001h\u001b\ufffd\u0011\ufffd\ufffd1PS\ufffd\u000e\ufffd@H\ufffd\u05ea\ufffd\ufffdH\u000e \ufffd\ufffdQ\ufffd\ufffd\ufffd\u001a\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\u0003\ufffd&^\ufffd\u02fe\ufffd\u0016f\u000e\ufffd\u0284\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdN\ufffd{<\ufffdph\ufffd\ufffd\ufffd1PS\ufffd\ufffd@H\ufffd\u05ea\ufffd\ufffdH \ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\ufffd&^\ufffd\u02fe\ufffdf\ufffd\u0284&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdN\ufffd\u001c{<\ufffdp\u0001h\u001b\ufffd\u0011\ufffd\ufffd1PS\ufffd\u000e\ufffd@H\ufffd\u05ea\ufffd\ufffdH\u000e \ufffd\ufffdQ\ufffd\ufffd\ufffd\u001a\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\u0003\ufffd&^\ufffd\u02fe\ufffd\u0016f\u000e\ufffd\u0284\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdN\ufffd{<\ufffdph\ufffd\ufffd\ufffd1PS\ufffd\ufffd@H\ufffd\u05ea\ufffd\ufffdH \ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdg\ufffdf\ufffd\ufffdt\ufffdl\ufffd\ufffd\ufffd&^\ufffd\u02fe\ufffdf\ufffd\u0284&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"net_mssql_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1433 · MSSQL
|
mssql
|
mssql probe
mssql probe · via MSSQL:1433 · (sonde / probe)
|
Élevée
|
Faible · 36
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
mssql_emulated
mssql_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
GET / HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accep
Pourquoi cette classification : Type « mssql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1433
User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Accept: */*
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 148,
"payload_entropy": 5.1089052248871285,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mssql",
"app_proto": "mssql",
"asn": 14061,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25
},
"risk_score": 36,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f93adaca9f40880298f96a6f0f3e4baf34caa9e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3bbdfd1c25b17b19fb36a413b0cdb9c1",
"path_pattern_hash": "6d4ca317e1154f7afb07772c79279a04"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fd3264bed5e57703e266f9a12f24f3176e1a599",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 36\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 36
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"mssql_emulated",
"mssql_payload",
"net_mssql_probe"
],
"asn_dc_heuristic": true
}
|