Renseignement sur les menaces

Ukraine

149.102.240.89

FAI Datacamp Limited Première vue 26/07/2026 22:28 UTC Dernière vue 27/07/2026 07:08 UTC Risque Moyen

Période analysée : 2026-06-27 → 2026-07-27

Activité suspecte — risque 53/100 (Moyen) — MITRE TA0007 — confiance 49 % — via HTTP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 53/100 Moyen

Première observation 26/07/2026 22:28 UTC

Dernière observation 27/07/2026 07:08 UTC

Événements (période) 26

MITRE ATT&CK principal TA0007 24 occurrences

Activité suspecte — risque 53/100 (Moyen) — MITRE TA0007 — confiance 49 % — via HTTP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « clickhouse_probe » (signaux protocolaires) · confiance 49%

Confiance 49 % — Score WAF 100 · 5 tag(s) WAF

Comparaison ASN / FAI

ASN 212238 · 149.102.240.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 26 événements sur la période pour cette IP.

37.19.195.90 Sonde Memcached 27/07/2026 16:33 UTC
82.21.56.9 Sonde Elasticsearch 27/07/2026 15:46 UTC
82.21.59.37 couchdb probe 27/07/2026 12:25 UTC
147.90.209.26 minio-console 27/07/2026 11:06 UTC
149.102.229.182 clickhouse probe 27/07/2026 03:54 UTC
82.21.59.56 Cross-site scripting 27/07/2026 01:10 UTC
82.24.215.141 Cross-site scripting 26/07/2026 23:06 UTC
170.62.100.27 socks5 probe 26/07/2026 20:18 UTC

Événements (filtres)

Première observation

26/07/2026 22:28 UTC

Dernière observation

27/07/2026 07:08 UTC

Dernière activité (filtres)

27/07/2026 07:08 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 20 COUCHDB TCP 3 DOCKER TCP 3

HTTP

COUCHDB

DOCKER

Géolocalisation

Origine réseau déclarée

Ukraine unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Datacamp Limited 0 Port 8123 clickhouse_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

clickhouse probe · via HTTP:8123 · (sonde / probe)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: curl/8

Aperçu payload

GET /?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_f

Port / service

8123 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0737

Confiance

49% Confiance modérée — signal unique

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

26 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

26 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/07/2026 07:08:20 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête `GET /?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20LIMIT%2010 HTTP/1.1` User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_f Requête brute (extrait) GET /?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "821663cea0bbb3ac5a04da6ef5680ee4f27ad424", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 371, "payload_entropy": 5.3247601247147305, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "497503e1739250bfd2fd3841413cad98ea7cbe3e", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "b6af7e85fcf993326fa1424f3a792908", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20LIMIT%2010", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20LIMIT%2010 HTTP\/1.1", "payload_snippet": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_f", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20LIMIT%2010", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20LIMIT%2010 HTTP\/1.1", "request_sample": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29", "payload_snippet": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b2a199e996ef2a479840306753d21edc52a4629", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_f", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_fb_user%7Cfb_user%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Cname%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28u_client%7Cskakapp%7Capp_f", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 06:39:25 UTC	TCP	8123 · HTTP	http	Sonde port 8123/TCP port 8123 tcp · via HTTP:8123 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Preuve honeypot — Sonde port 8123/TCP Connexion détectée sur le port 8123 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_8123_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8123 User-Agent: curl/8 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.193753464020308, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 1, "campaign_key": "9fa83b631b47c2a330b4d59d07a14c0ec24c59e5", "event_fingerprint": "12d54887e9b449f1412515f589d0a10f48748249", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "383ce9cbdaf89ac66638f09759e329f3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf9895a42d239499c071e79661527abe485813a5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 06:35:33 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête `GET /?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20AND%20total_rows%20%3E%20100%20LIMIT%2010 HTTP/1.1` User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbre Requête brute (extrait) GET /?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "5b36fab56d1a32a1b85a0623f01f8c69bdd4c13d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 476, "payload_entropy": 5.219807642938099, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "7c7cd8919272763be2e8f1e22cc3d50b625e486d", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "35cee7bc9ff22e27b8f0994e88713525", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20AND%20total_rows%20%3E%20100%20LIMIT%2010", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20AND%20total_rows%20%3E%20100%20LIMIT%2010 HTTP\/1.1", "payload_snippet": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbre", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20AND%20total_rows%20%3E%20100%20LIMIT%2010", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN%20%28%27system%27%2C%27INFORMATION_SCHEMA%27%2C%27information_schema%27%29%20AND%20total_rows%20%3E%20100%20LIMIT%2010 HTTP\/1.1", "request_sample": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_stealer%7Cparsed_logs%29%27%29%20AND%20database%20NOT%20IN%", "payload_snippet": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbre", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "69f4d987297a316a7a4ecebbe27fdf1184237881", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_st\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbre", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbreach%7Cleak%7Cdump%7Ccombo%7Credline%7Craccoon%7Cvidar%7Clumma%7Cmeta_st\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Cname%2Ctotal_rows%20FROM%20system.tables%20WHERE%20match%28lower%28name%29%2C%27%28stealer%7Cbre", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 06:15:57 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "a188491183ce0f82cc9b34aec12281908fc1e44c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 1015, "payload_entropy": 5.025393174295087, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "7521f23b5d84c64f5123df59ca34b30117961fd4", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:57:45 UTC	TCP	8123 · HTTP	http	Sonde port 8123/TCP port 8123 tcp · via HTTP:8123 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Preuve honeypot — Sonde port 8123/TCP Connexion détectée sur le port 8123 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_8123_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8123 User-Agent: curl/8 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.193753464020308, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 1, "campaign_key": "9fa83b631b47c2a330b4d59d07a14c0ec24c59e5", "event_fingerprint": "12d54887e9b449f1412515f589d0a10f48748249", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "383ce9cbdaf89ac66638f09759e329f3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf9895a42d239499c071e79661527abe485813a5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:56:35 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "a188491183ce0f82cc9b34aec12281908fc1e44c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 1015, "payload_entropy": 5.025393174295087, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "7521f23b5d84c64f5123df59ca34b30117961fd4", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:42:54 UTC	TCP	8123 · HTTP	http	Sonde port 8123/TCP port 8123 tcp · via HTTP:8123 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Preuve honeypot — Sonde port 8123/TCP Connexion détectée sur le port 8123 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_8123_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8123 User-Agent: curl/8 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.193753464020308, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 1, "campaign_key": "9fa83b631b47c2a330b4d59d07a14c0ec24c59e5", "event_fingerprint": "12d54887e9b449f1412515f589d0a10f48748249", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "383ce9cbdaf89ac66638f09759e329f3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf9895a42d239499c071e79661527abe485813a5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:24:17 UTC	TCP	8123 · HTTP	http	Sonde port 8123/TCP port 8123 tcp · via HTTP:8123 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Preuve honeypot — Sonde port 8123/TCP Connexion détectée sur le port 8123 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_8123_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8123 User-Agent: curl/8 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.193753464020308, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 1, "campaign_key": "9fa83b631b47c2a330b4d59d07a14c0ec24c59e5", "event_fingerprint": "12d54887e9b449f1412515f589d0a10f48748249", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "383ce9cbdaf89ac66638f09759e329f3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf9895a42d239499c071e79661527abe485813a5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:24:17 UTC	TCP	9004 · HTTP	http	Sonde port 9004/TCP port 9004 tcp · via HTTP:9004 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9004 Chemin / cible / Preuve honeypot — Sonde port 9004/TCP Connexion détectée sur le port 9004 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_9004_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:9004 User-Agent: curl/8 Connection: close Meta JSON brut { "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "f5f83bc1a484ffdb613ff8a58150966a7f7c4d49", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.2303295217292565, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 9004, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 20, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 20 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 1, "campaign_key": "dec949ede49a5128d36ec32c3a2d5d1633af941c", "event_fingerprint": "5772f3f0f910a44762d003a2c5fcf8d69b50109c", "classification_reason": "Type \u00ab port_9004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 20, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "d3e695cd958c15eb9a85a3931da68e6c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9004, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_9004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "178bd51c27a5955c8bcf5c2052e8a980fa75f2d0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 9004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 9004 tcp \u00b7 via HTTP:9004 \u00b7 (sonde \/ probe)", "target_port_label": "9004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_9004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_9004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 20, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9004, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 9004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 9004 tcp \u00b7 via HTTP:9004 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9004\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "9004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "scanner-ua" ] }
27/07/2026 05:22:36 UTC	TCP	8123 · HTTP	http	Sonde port 8123/TCP port 8123 tcp · via HTTP:8123 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Preuve honeypot — Sonde port 8123/TCP Connexion détectée sur le port 8123 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_8123_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8123 User-Agent: curl/8 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.193753464020308, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 1, "campaign_key": "9fa83b631b47c2a330b4d59d07a14c0ec24c59e5", "event_fingerprint": "12d54887e9b449f1412515f589d0a10f48748249", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "383ce9cbdaf89ac66638f09759e329f3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf9895a42d239499c071e79661527abe485813a5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:22:22 UTC	TCP	8123 · HTTP	http	Sonde port 8123/TCP port 8123 tcp · via HTTP:8123 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Preuve honeypot — Sonde port 8123/TCP Connexion détectée sur le port 8123 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_8123_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /?query=SHOW%20DATABASES HTTP/1.1` User-Agent curl/8 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SHOW%20DATABASES HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8123 User-Agent: curl/8 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "fdf86d4f1b483f5ec36c5f63c0d2edab7b9dddbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.193753464020308, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 1, "campaign_key": "9fa83b631b47c2a330b4d59d07a14c0ec24c59e5", "event_fingerprint": "12d54887e9b449f1412515f589d0a10f48748249", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "383ce9cbdaf89ac66638f09759e329f3", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n", "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SHOW%20DATABASES", "user_agent": "curl\/8", "waf_tags": [ "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "request_sample": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf9895a42d239499c071e79661527abe485813a5", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_8123_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SHOW%20DATABASES HTTP\/1.1", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8123 tcp \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SHOW%20DATABASES HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8123\r\nUser-Agent: curl\/8\r\nConnection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:19:08 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "534bac716172b1591ced9a824d0447147467260c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 979, "payload_entropy": 5.044501947928903, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "6615cd79a77cc1e25b4d54a82735edadc8a6011f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:17:25 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "534bac716172b1591ced9a824d0447147467260c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 979, "payload_entropy": 5.044501947928903, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "6615cd79a77cc1e25b4d54a82735edadc8a6011f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:14:21 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "534bac716172b1591ced9a824d0447147467260c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 979, "payload_entropy": 5.044501947928903, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "6615cd79a77cc1e25b4d54a82735edadc8a6011f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:08:33 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "534bac716172b1591ced9a824d0447147467260c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 979, "payload_entropy": 5.044501947928903, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "6615cd79a77cc1e25b4d54a82735edadc8a6011f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 05:06:24 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "534bac716172b1591ced9a824d0447147467260c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 979, "payload_entropy": 5.044501947928903, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "6615cd79a77cc1e25b4d54a82735edadc8a6011f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 04:50:00 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "534bac716172b1591ced9a824d0447147467260c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 979, "payload_entropy": 5.044501947928903, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "6615cd79a77cc1e25b4d54a82735edadc8a6011f", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 04:44:05 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "e7f107b643979f3f47591909235336f90b4620ff", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 992, "payload_entropy": 5.039097054237931, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "a8a20d5bd64335ddd0ad17a89e0f03e456b6bfd9", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 04:31:08 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "e7f107b643979f3f47591909235336f90b4620ff", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 992, "payload_entropy": 5.039097054237931, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "a8a20d5bd64335ddd0ad17a89e0f03e456b6bfd9", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 04:06:00 UTC	TCP	8123 · HTTP	http	clickhouse probe clickhouse probe · via HTTP:8123 · (sonde / probe)	Élevée	Moyen · 53
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA curl/8 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950005:sqli-1 950037:sqli-9 950325:rce-0 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Type « clickhouse_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 49 % — Motif catalogue confirmé · 5 tag(s) WAF Protocole émulé 1 Signaux pat-0737 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ClickHouse query Ligne de requête GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e User-Agent curl/8 Règles WAF sqli-1 sqli-9 rce-0 sap-sapcontrol-path scanner-ua Payload (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr Requête brute (extrait) GET /?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis% Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "a13d219e5ded760716f5952758285c6f6a575108", "http_host_hash": "15f4f9799fa92d8e7e5cb90724eb1ec2b33ec46f", "http_target_hash": "e7f107b643979f3f47591909235336f90b4620ff", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 992, "payload_entropy": 5.039097054237931, "port_category": "registered", "org": "Datacamp Limited", "service": "http", "app_proto": "http", "asn": 212238, "country": "UA", "dst_port": 8123, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 35, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35 }, "risk_score": 53, "tag_count": 9, "anomaly_count": 2, "campaign_key": "e84efbc9ffcdb7d0dd5ae8251a2f0667c7a8bbf7", "event_fingerprint": "a8a20d5bd64335ddd0ad17a89e0f03e456b6bfd9", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0737" ], "kb_rule_ids": [ "pat-0737" ], "matched_patterns": [ "pat-0737" ], "matched_pattern_names": [ "ClickHouse query" ], "pattern_ids": [ "pat-0737" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d26c0650abb48cff3c037b137b03713f", "payload_hash": "2607fcf4e9e07c0a33f5849c9df5ccef", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 53 }, "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "evidence": { "method": "GET", "path": "\/", "query_string": "query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29epin%28", "user_agent": "curl\/8", "waf_tags": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "scanner-ua" ], "waf_rule_names": [ "sqli-1", "sqli-9", "rce-0", "sap-sapcontrol-path", "scanner-ua" ], "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%7Ctax_lot%7Crealized_gain%7Cform8949%7Ckoinly%7Ctokentax%7Ccointracker%7Ccard_number%7C%28%5E%7C_%29cvv%28_%7C%24%29%7Cpassword_digest%7Cpass_code%7Capi_secret%7Cwallet_priv%7Csession_token%7C%28%5E%7C_%29ssn%28_%7C%24%29%7Cssnit%7Cvoucher%7C%28%5E%7C_%29e", "request_sample": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%7Csecret_key%7Cpassport%7Cnational_id%7Cssn%7Ccost_basis%", "payload_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8740ea8e95aacbc11558983ac9e28ceea71ceac0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab clickhouse_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTP", "confidence_pct": 49, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 35, "risk_score": 53 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "pat-0737" ], "tags_summary_labels_fr": [ "pat-0737" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cprivate_key%7Cmnemonic%7Cseed_phrase%7Cseed_key%7Ckeystore%7Csigning_key%\u2026", "http_user_agent": "curl\/8", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "clickhouse probe \u00b7 via HTTP:8123 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?query=SELECT%20database%2Ctable%2Cname%20FROM%20system.columns%20WHERE%20match%28lower%28name%29%2C%27moonshot%7Ckimi%7Cpr", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950005:sqli-1", "950037:sqli-9", "950325:rce-0", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
27/07/2026 00:37:24 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflat Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflat Requête brute (extrait) GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 174, "payload_entropy": 5.164358030153518, "port_category": "registered", "org": "Datacamp Limited", "service": "docker", "app_proto": "docker", "asn": 212238, "country": "UA", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 23, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0a15829aa2daf6268082573a1b10938c", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 23 }, "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "request_sample": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "evidence": { "request_sample": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "efd508835a079d15ee8490482c8029fcef18233c", "protocol_details": { "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 23, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflat", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "net_docker_api_probe" ] }
27/07/2026 00:35:07 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: curl/8.18.0 Accept: / Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 103, "payload_entropy": 5.034197926604564, "port_category": "registered", "org": "Datacamp Limited", "service": "docker", "app_proto": "docker", "asn": 212238, "country": "UA", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 23, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "81849c5f26340ee8043ecef09b646ea1", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 23 }, "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "request_sample": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6dd61e34f5b6e2138f8932ce7c1d08d72b7c5ba8", "protocol_details": { "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 23, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "net_docker_api_probe" ] }
27/07/2026 00:20:06 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: curl/8.18.0 Accept: / Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /containers/json?all=true HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 103, "payload_entropy": 5.034197926604564, "port_category": "registered", "org": "Datacamp Limited", "service": "docker", "app_proto": "docker", "asn": 212238, "country": "UA", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 23, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "81849c5f26340ee8043ecef09b646ea1", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 23 }, "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "request_sample": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6dd61e34f5b6e2138f8932ce7c1d08d72b7c5ba8", "protocol_details": { "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 23, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/containers\/json?all=true HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "net_docker_api_probe" ] }
27/07/2026 00:15:05 UTC	TCP	5984 · COUCHDB	couchdb	couchdb probe couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload http_get_probe net_couchdb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.18.0 Accept: / Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534", "emulator_response_len": 286, "bytes_in": 79, "payload_entropy": 4.86551607801531, "port_category": "registered", "org": "Datacamp Limited", "service": "couchdb", "app_proto": "couchdb", "asn": 212238, "country": "UA", "dst_port": 5984, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 34, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04", "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "couchdb", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2a902a5bc55c68bdb32569b26ebfb0a", "path_pattern_hash": "ce747dac2688338e030a6b5f71103175" }, "target_context": { "dst_port": 5984, "service": "couchdb", "service_name": "couchdb", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "203ba57536cc4ae53d0e4612b46d6bdd450353bb", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "couchdb", "service_label_fr": "COUCHDB", "dst_port": 5984, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-couchdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "couchdb", "service_banner": "honeypot-couchdb", "service_os": "linux", "dst_port": "5984" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "couchdb_emulated", "couchdb_payload", "http_get_probe", "net_couchdb_probe" ] }
27/07/2026 00:15:05 UTC	TCP	5984 · COUCHDB	couchdb	couchdb probe couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload couchdb_probe couchdb_rest_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.18.0 Accept: / Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Infra Couchdb Db Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534", "emulator_response_len": 286, "bytes_in": 87, "payload_entropy": 5.027625289560124, "port_category": "registered", "org": "Datacamp Limited", "service": "couchdb", "app_proto": "couchdb", "asn": 212238, "country": "UA", "dst_port": 5984, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "eeb24ede3f547bd086820dac13d3da57d36ee8f1", "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 87, "precision_signals": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "kb_rule_ids": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48 }, "named_classification_skipped": false, "service_name": "couchdb", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "37106f7c91557fb8f2df15ef0489f94a", "path_pattern_hash": "ce747dac2688338e030a6b5f71103175" }, "target_context": { "dst_port": 5984, "service": "couchdb", "service_name": "couchdb", "risk_score": 48 }, "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d9737bb60a49df393f4c2659003508106c8ae51", "protocol_details": { "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "couchdb", "service_label_fr": "COUCHDB", "dst_port": 5984, "protocol_emulated": true, "tags_summary": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "tags_summary_labels_fr": [ "Infra Couchdb Db", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-couchdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "couchdb", "service_banner": "honeypot-couchdb", "service_os": "linux", "dst_port": "5984" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "couchdb_emulated", "couchdb_payload", "couchdb_probe", "couchdb_rest_probe", "http_get_probe", "net_couchdb_probe" ] }
26/07/2026 22:28:44 UTC	TCP	5984 · COUCHDB	couchdb	couchdb probe couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload couchdb_probe couchdb_rest_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.18.0 Accept: / Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Infra Couchdb Db Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.18.0 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534", "emulator_response_len": 286, "bytes_in": 87, "payload_entropy": 5.027625289560124, "port_category": "registered", "org": "Datacamp Limited", "service": "couchdb", "app_proto": "couchdb", "asn": 212238, "country": "UA", "dst_port": 5984, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "eeb24ede3f547bd086820dac13d3da57d36ee8f1", "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 87, "precision_signals": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "kb_rule_ids": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48 }, "named_classification_skipped": false, "service_name": "couchdb", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "37106f7c91557fb8f2df15ef0489f94a", "path_pattern_hash": "ce747dac2688338e030a6b5f71103175" }, "target_context": { "dst_port": 5984, "service": "couchdb", "service_name": "couchdb", "risk_score": 48 }, "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "evidence": { "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d9737bb60a49df393f4c2659003508106c8ae51", "protocol_details": { "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "couchdb", "service_label_fr": "COUCHDB", "dst_port": 5984, "protocol_emulated": true, "tags_summary": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "tags_summary_labels_fr": [ "Infra Couchdb Db", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-couchdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.18.0\r\nAccept: \/", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "couchdb", "service_banner": "honeypot-couchdb", "service_os": "linux", "dst_port": "5984" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "couchdb_emulated", "couchdb_payload", "couchdb_probe", "couchdb_rest_probe", "http_get_probe", "net_couchdb_probe" ] }

149.102.240.89

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence