|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /storage/logs/debug%2elog
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /storage/logs/debug%2elog UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/storage/logs/debug%2elog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/storage/logs/debug%2elog
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /storage/logs/debug%2elog HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /storage/logs/debug%2elog HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /storage/logs/debug%2elog HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "107b1331f64b1ef3a98d387ed54557075ae96f5b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.144782381053874,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "f5290984b26c720e8ddd64c0b78b315b74057107",
"event_fingerprint": "8b44938278736c0d13e39db53e5c6141f4499e16",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "af9e934e4fcd6dacf10430b11a18b81f",
"path_pattern_hash": "98dd6005e7138af06990cbd81de2f4ca"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/storage\/logs\/debug%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/storage\/logs\/debug%2elog HTTP\/1.1",
"request_sample": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/storage\/logs\/debug%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/storage\/logs\/debug%2elog HTTP\/1.1",
"request_sample": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5fb5dc6dd702c29ea3e5fa497b88c8dc2a70e601",
"protocol_details": {
"http_method": "GET",
"http_path": "\/storage\/logs\/debug%2elog",
"request_line": "GET \/storage\/logs\/debug%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/logs\/debug%2elog",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/storage\/logs\/debug%2elog",
"request_line": "GET \/storage\/logs\/debug%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/logs\/debug%2elog",
"evidence_snippet": "GET \/storage\/logs\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /%2eaws/credentials_eks
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%2eaws/credentials_eks UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/%2eaws/credentials_eks
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/%2eaws/credentials_eks
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eaws/credentials_eks HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eaws/credentials_eks HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /%2eaws/credentials_eks HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "ae041fb40769913bcc55f43e1d5d089621723b24",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.147545039789841,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "0ae534461fbb093ca1a38335ad3b3c874508926b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "470f0dc67167a84b3058d90b3263053e",
"path_pattern_hash": "4a2a2c7abea61f23f0ff1df2adcd87e8"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/%2eaws\/credentials_eks",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eaws\/credentials_eks HTTP\/1.1",
"request_sample": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/%2eaws\/credentials_eks",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eaws\/credentials_eks HTTP\/1.1",
"request_sample": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "950692e96c7cdd64f83125e45d2b4d44678397a8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eaws\/credentials_eks",
"request_line": "GET \/%2eaws\/credentials_eks HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eaws\/credentials_eks",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eaws\/credentials_eks",
"request_line": "GET \/%2eaws\/credentials_eks HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eaws\/credentials_eks",
"evidence_snippet": "GET \/%2eaws\/credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /actuator/features
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /actuator/features UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/actuator/features
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/actuator/features
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /actuator
Ligne de requête
GET /actuator/features HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /actuator/features HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /actuator/features HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "040436c50a2c6706bb67e1094aa845d47f3d6541",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.11926136033028,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "dc1adf350b559d5df355b674c7abca991b939071",
"event_fingerprint": "a2fd73628d86f6d981ef4599b04d4e8e8fdb6161",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0232"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/actuator"
],
"pattern_ids": [
"pat-0340",
"pat-0232"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "bf3fa998f1ab20f0a40b0c12f3cf3f9a",
"path_pattern_hash": "249d9ffc78d0319db0fa5de14f4a205b"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/actuator\/features",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/actuator\/features HTTP\/1.1",
"request_sample": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/actuator\/features",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/actuator\/features HTTP\/1.1",
"request_sample": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b6aed774ae3501647d778de100afa8646d8eeeb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/actuator\/features",
"request_line": "GET \/actuator\/features HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/actuator\/features",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/actuator\/features",
"request_line": "GET \/actuator\/features HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/actuator\/features",
"evidence_snippet": "GET \/actuator\/features HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_actuator",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /backup/config%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /backup/config%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/backup/config%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/backup/config%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backup/config%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /backup/config%2exml HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /backup/config%2exml HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "dfa137a0790baec9345e9a88a6127cc171494828",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.181772655836136,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "6027b9c3a39d3c2d506151eb4e9f07f9fb5d716d",
"event_fingerprint": "6191fc36642de807c168fc81c7c61f6bb3b2d8fa",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "72ef343a27a79dadb8be08b2d3a7816c",
"path_pattern_hash": "ddb62a25221ce2fb29c07035a7e7a3eb"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/backup\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup\/config%2exml HTTP\/1.1",
"request_sample": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/backup\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup\/config%2exml HTTP\/1.1",
"request_sample": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f495c0ad3c98b7df14cf0aa888af68bafe23bee5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup\/config%2exml",
"request_line": "GET \/backup\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup\/config%2exml",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup\/config%2exml",
"request_line": "GET \/backup\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup\/config%2exml",
"evidence_snippet": "GET \/backup\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_backup",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /gcp-key_sns
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /gcp-key_sns UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/gcp-key_sns
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/gcp-key_sns
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /gcp-key_sns HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /gcp-key_sns HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /gcp-key_sns HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "211554f9c7835f7ef24e313bd6e622388443f3c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.136330721270586,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "7d3d0904ce7b0755ff25c10c117439ab22bcba65",
"event_fingerprint": "f5fd05474f790d680ec036b579a5f5e2f0fa0baf",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "b28afd2bd71973f67819fe76fe43d1c5",
"path_pattern_hash": "3b52018bc75f63c89e44683b01ca7b63"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/gcp-key_sns",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/gcp-key_sns HTTP\/1.1",
"request_sample": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/gcp-key_sns",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/gcp-key_sns HTTP\/1.1",
"request_sample": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36066d229f94a2934351fb94bb717c56fa2a35a7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/gcp-key_sns",
"request_line": "GET \/gcp-key_sns HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/gcp-key_sns",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/gcp-key_sns",
"request_line": "GET \/gcp-key_sns HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/gcp-key_sns",
"evidence_snippet": "GET \/gcp-key_sns HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /backend/id_ed25519%2epub
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/id_ed25519%2epub UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/backend/id_ed25519%2epub
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/backend/id_ed25519%2epub
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred SSH private key ed25519
SSRF Localhost SSRF
Ligne de requête
GET /backend/id_ed25519%2epub HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /backend/id_ed25519%2epub HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /backend/id_ed25519%2epub HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "b48e51a9854821299c64162663c174aa523e871b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.178510074143924,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "3a68bb685ff19b95c2ba222e23cb09fedd66e7d9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0492",
"pat-0340"
],
"matched_pattern_names": [
"Cred SSH private key ed25519",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0492",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "10f9164e06c3d4fe6dcf829095e2429a",
"path_pattern_hash": "a77cc7b4322bf84ad61e5694e58cd54e"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/backend\/id_ed25519%2epub",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/id_ed25519%2epub HTTP\/1.1",
"request_sample": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/backend\/id_ed25519%2epub",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/id_ed25519%2epub HTTP\/1.1",
"request_sample": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48ea5922a7ce91e6362c47463f3684117cf9b24c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/id_ed25519%2epub",
"request_line": "GET \/backend\/id_ed25519%2epub HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/id_ed25519%2epub",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/id_ed25519%2epub",
"request_line": "GET \/backend\/id_ed25519%2epub HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/id_ed25519%2epub",
"evidence_snippet": "GET \/backend\/id_ed25519%2epub HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /Helmetjs/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /Helmetjs/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/Helmetjs/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/Helmetjs/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /Helmetjs/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /Helmetjs/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /Helmetjs/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "9e9632ef3cdf3372088960f4ccb3e958b63dc42c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.150667409159691,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "2550e66e30b942ae14b6b28d04e2568e374c44b7",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c8a157413585731ded109a8b44dd7960",
"path_pattern_hash": "cb57b561051af2360ce699c4e6c581be"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/Helmetjs\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/Helmetjs\/%2eenv HTTP\/1.1",
"request_sample": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/Helmetjs\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/Helmetjs\/%2eenv HTTP\/1.1",
"request_sample": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e98a36fbba0c3b7c78e4203cb72c85417a1b23d8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Helmetjs\/%2eenv",
"request_line": "GET \/Helmetjs\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Helmetjs\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/Helmetjs\/%2eenv",
"request_line": "GET \/Helmetjs\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Helmetjs\/%2eenv",
"evidence_snippet": "GET \/Helmetjs\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /freeppx/config%2ephp
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /freeppx/config%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/freeppx/config%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/freeppx/config%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /freeppx/config%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /freeppx/config%2ephp HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /freeppx/config%2ephp HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "8d1b1a33b9e272b0e5e49b2dd662439131d8a50f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.1628566278613786,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "4a69dabb80e6bdb256e05f8551219d447c651b54",
"event_fingerprint": "0a7e5146fac977645e12f316b8585fb7e3dca24d",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3bead9f2abfbc80e73c3b4a8018abd2a",
"path_pattern_hash": "01f82f312f536ec2ad47a4ed2f7de0f3"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/freeppx\/config%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/freeppx\/config%2ephp HTTP\/1.1",
"request_sample": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/freeppx\/config%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/freeppx\/config%2ephp HTTP\/1.1",
"request_sample": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c481386a97006478509e08ac0ce770876f6b4e7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/freeppx\/config%2ephp",
"request_line": "GET \/freeppx\/config%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/freeppx\/config%2ephp",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/freeppx\/config%2ephp",
"request_line": "GET \/freeppx\/config%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/freeppx\/config%2ephp",
"evidence_snippet": "GET \/freeppx\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /backend/client%2epem
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/client%2epem UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/backend/client%2epem
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/backend/client%2epem
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backend/client%2epem HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /backend/client%2epem HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /backend/client%2epem HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "564890d96271f62d9e4142c216b0270033fec672",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.146310907151403,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "a862a2b053583c47b91db135f5a2d62859228e86",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "eb1dc1c82cb6a748232c0d8d8a888868",
"path_pattern_hash": "93769ba0aa92012636e6fcfdf62414c9"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/backend\/client%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/client%2epem HTTP\/1.1",
"request_sample": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/backend\/client%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/client%2epem HTTP\/1.1",
"request_sample": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6178ddaf6290986b4db054c8168d6aa8733028cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/client%2epem",
"request_line": "GET \/backend\/client%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/client%2epem",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/client%2epem",
"request_line": "GET \/backend\/client%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/client%2epem",
"evidence_snippet": "GET \/backend\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /mail/smtp%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /mail/smtp%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/mail/smtp%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/mail/smtp%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /mail/smtp%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /mail/smtp%2ejson HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /mail/smtp%2ejson HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "a6069afd69534a3b8036b45ed3c437409ded9d66",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.159254613593006,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "c2b4a20802ad82b244efc15eac8ddf9c6dcd4b98",
"event_fingerprint": "e35b67b9c3308bf2d702de3b095deae397615a9c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f33c15901971953fde895d6cf25b0e06",
"path_pattern_hash": "92eb59818efea32cd6e485de6a8fff55"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/mail\/smtp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mail\/smtp%2ejson HTTP\/1.1",
"request_sample": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/mail\/smtp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mail\/smtp%2ejson HTTP\/1.1",
"request_sample": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f0c6b29f9dfa085a61e01ffdb426d005b38c898a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/smtp%2ejson",
"request_line": "GET \/mail\/smtp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/smtp%2ejson",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/smtp%2ejson",
"request_line": "GET \/mail\/smtp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/smtp%2ejson",
"evidence_snippet": "GET \/mail\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_mail",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /apis/%2eenv%2eproduction
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /apis/%2eenv%2eproduction UA curl/8.7.1
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/apis/%2eenv%2eproduction
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/apis/%2eenv%2eproduction
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /apis/%2eenv%2eproduction HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /apis/%2eenv%2eproduction HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /apis/%2eenv%2eproduction HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "b25a97644079bc928eaed483085d984d3cce09bb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.145005812815975,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 22,
"anomaly_count": 1,
"campaign_key": "58181776649761d36deb2128e09a91b7b4c2246a",
"event_fingerprint": "3367c17e57dd774ebcd87c2147ce79445aa90841",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "af5b29825b7f2b54c8481dea7c84a1b0",
"path_pattern_hash": "e5fe8bf4c6584c990e44bd09eb48cf2c"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/apis\/%2eenv%2eproduction",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1",
"request_sample": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/apis\/%2eenv%2eproduction",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1",
"request_sample": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db0699ea30e725e5827f8a33bae31e7d3f95577f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apis\/%2eenv%2eproduction",
"request_line": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apis\/%2eenv%2eproduction",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/apis\/%2eenv%2eproduction",
"request_line": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apis\/%2eenv%2eproduction",
"evidence_snippet": "GET \/apis\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_k8s_probe",
"http_probe_k8s_apis",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /api/upload/secret%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/upload/secret%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/upload/secret%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/api/upload/secret%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/upload/secret%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/upload/secret%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /api/upload/secret%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "2577eaccaeece3765fde6eead2cd7c3b06f0e3af",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.141073662785715,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "35504403b334e347f68dc1c5cddd48ac54c49842",
"event_fingerprint": "34eec2534874211de912a2a99d20130f2451acff",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "32f32f13db7a2bc2135bf440e5e85994",
"path_pattern_hash": "65e71d6e3ab27da925002c9676ccf29f"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/api\/upload\/secret%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/upload\/secret%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/api\/upload\/secret%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/upload\/secret%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d8ad2f294030c89c41ee6333ffd7ff17ddd1efa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/upload\/secret%2eenv",
"request_line": "GET \/api\/upload\/secret%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/upload\/secret%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/upload\/secret%2eenv",
"request_line": "GET \/api\/upload\/secret%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/upload\/secret%2eenv",
"evidence_snippet": "GET \/api\/upload\/secret%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /config/queue%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/queue%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/queue%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/config/queue%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/queue%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/queue%2ejs HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /config/queue%2ejs HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "5dad981f564383b81c142eb90bfe3e5d4ddd1d60",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.1499993936552215,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "a102dbf542954187d6bc0a80a5bd145e56159e2b",
"event_fingerprint": "5e16c917aea9a7982f9a29b41e3b644b0f059fa2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "da1bc97c680cd56f4a41ab77babee2f2",
"path_pattern_hash": "79ad7fa53f46acad6ed371543896b095"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/config\/queue%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/queue%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/config\/queue%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/queue%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a15a27d1966c465b91068704d4f85973e65b81c5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/queue%2ejs",
"request_line": "GET \/config\/queue%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/queue%2ejs",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/queue%2ejs",
"request_line": "GET \/config\/queue%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/queue%2ejs",
"evidence_snippet": "GET \/config\/queue%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /tsconfig%2eapp%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /tsconfig%2eapp%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/tsconfig%2eapp%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/tsconfig%2eapp%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /tsconfig%2eapp%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /tsconfig%2eapp%2ejson HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /tsconfig%2eapp%2ejson HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "dfc6c37f6704968dae27c4cd7822e19c7d6de17b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.155242412680628,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "7d3d0904ce7b0755ff25c10c117439ab22bcba65",
"event_fingerprint": "fa440aa9b1305a615733cc87d236c6dbb0663390",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5c0637be99220e630d92adcfb9cff40c",
"path_pattern_hash": "b1e6a513fb39fce400551b9d769c7c96"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/tsconfig%2eapp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1",
"request_sample": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/tsconfig%2eapp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1",
"request_sample": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c676d365bac8a18c22b972c5a84e79478472af32",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tsconfig%2eapp%2ejson",
"request_line": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tsconfig%2eapp%2ejson",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/tsconfig%2eapp%2ejson",
"request_line": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tsconfig%2eapp%2ejson",
"evidence_snippet": "GET \/tsconfig%2eapp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /cart%2ephp%2eold
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /cart%2ephp%2eold UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950521:leak-8
951041:dns-rebind
Cible HTTP
GET
/cart%2ephp%2eold
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/cart%2ephp%2eold
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /cart%2ephp%2eold HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /cart%2ephp%2eold HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /cart%2ephp%2eold HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "f05808571e5ac0c0e468a356f770024961a1f34e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.138149040040301,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "cd9af82ff800d30a09c277b474b5f6f2ef5a6747",
"event_fingerprint": "556eb066bdd6ffc3f25cd6a837a4f7812ede3699",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e3f6498e2fde63073bb7b2c4496e0782",
"path_pattern_hash": "8ac3b6272b4abd2567c335101a94a23d"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/cart%2ephp%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cart%2ephp%2eold HTTP\/1.1",
"request_sample": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/cart%2ephp%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cart%2ephp%2eold HTTP\/1.1",
"request_sample": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "492b1cfb6617ccf3faad7c455300f6b0f32d6760",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cart%2ephp%2eold",
"request_line": "GET \/cart%2ephp%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cart%2ephp%2eold",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cart%2ephp%2eold",
"request_line": "GET \/cart%2ephp%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cart%2ephp%2eold",
"evidence_snippet": "GET \/cart%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /wp-config
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /wp-config UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/wp-config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/wp-config
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-config HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-config HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-
Requête brute (extrait)
GET /wp-config HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "47dfb03e42728823ea0b9feca1b4c866aff116ba",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 373,
"payload_entropy": 5.118012982718385,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "7d3d0904ce7b0755ff25c10c117439ab22bcba65",
"event_fingerprint": "8d6410e0d3af1441286eb218168051e21a35f9f2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "9289336625cd4d57c827f52a6637aa7d",
"path_pattern_hash": "173ab59ca0a30f3f6ed8493a96767c81"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"method": "GET",
"path": "\/wp-config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-config HTTP\/1.1",
"request_sample": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-",
"payload_snippet": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"evidence": {
"method": "GET",
"path": "\/wp-config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-config HTTP\/1.1",
"request_sample": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-",
"payload_snippet": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b24370e327f7dbe0ba635477640559d1ba724cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config",
"request_line": "GET \/wp-config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config",
"request_line": "GET \/wp-config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config",
"evidence_snippet": "GET \/wp-config HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:2001 · (tentative d'exploit) · → /keys/id_rsa
|
Élevée
|
Élevé · 83
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /keys/id_rsa UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/keys/id_rsa
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/keys/id_rsa
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 83
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
SIGMA-web-credential-file
pat-0495
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred SSH private key id_rsa
SSRF Localhost SSRF
Ligne de requête
GET /keys/id_rsa HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /keys/id_rsa HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /keys/id_rsa HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "ac37ce7e667bd3bc1eba862f64c398c379fe2d59",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.143151789336193,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 83,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "d1419b32b9e7e3377dd4465aa3cd44f8cb478390",
"event_fingerprint": "1f89785c979a51ca621464bf143de5aa92157432",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 225,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0495",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0495",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0495",
"pat-0340"
],
"matched_pattern_names": [
"Cred SSH private key id_rsa",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0495",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 83
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7c4faa86f8720cd5847e8b0081ba005d",
"path_pattern_hash": "9d81f664fa843ac47730f41a2954f798"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 83
},
"payload_preview": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/keys\/id_rsa",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/keys\/id_rsa HTTP\/1.1",
"request_sample": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/keys\/id_rsa",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/keys\/id_rsa HTTP\/1.1",
"request_sample": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b730d292046605e8fa01452292db5e74dd8f63f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/keys\/id_rsa",
"request_line": "GET \/keys\/id_rsa HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "credential file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/keys\/id_rsa",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 83
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 83,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0495",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0495",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/keys\/id_rsa",
"request_line": "GET \/keys\/id_rsa HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/keys\/id_rsa",
"evidence_snippet": "GET \/keys\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_keys",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /_nodes/ingest_processors
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /_nodes/ingest_processors UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/_nodes/ingest_processors
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/_nodes/ingest_processors
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ES nodes API
Ligne de requête
GET /_nodes/ingest_processors HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /_nodes/ingest_processors HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /_nodes/ingest_processors HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "41b3281d36f9cc1ccc373d581a4d6e93170eed37",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.136137939537376,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "7d2f138e84925be3cf374c22f1a4a2c58a0a4b33",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340",
"pat-0344"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ES nodes API"
],
"pattern_ids": [
"pat-0340",
"pat-0344"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "b4860045e67d9c41b9ab678f1b216081",
"path_pattern_hash": "886fcd76cfccb4d7c131c7c092780bee"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/_nodes\/ingest_processors",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_nodes\/ingest_processors HTTP\/1.1",
"request_sample": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/_nodes\/ingest_processors",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_nodes\/ingest_processors HTTP\/1.1",
"request_sample": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88eddc5d14883d4c28842db4114179433a895a8e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_nodes\/ingest_processors",
"request_line": "GET \/_nodes\/ingest_processors HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_nodes\/ingest_processors",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_nodes\/ingest_processors",
"request_line": "GET \/_nodes\/ingest_processors HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_nodes\/ingest_processors",
"evidence_snippet": "GET \/_nodes\/ingest_processors HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /config/new/info%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/new/info%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/new/info%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/config/new/info%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/new/info%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/new/info%2ebak HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /config/new/info%2ebak HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "979aaf334ea8265c6b3233c83cd2078557d7c070",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.161124556815872,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "41ba69c257f87c43a92af5962e342e26db099808",
"event_fingerprint": "056dc21f2ba57b3c38316a8171c2b67154f977be",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "967fa8ec748ecce8a2e781f325d026fd",
"path_pattern_hash": "5bf401b0a383a345e61075a4d87558f9"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/config\/new\/info%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/new\/info%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/config\/new\/info%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/new\/info%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "90ae7fb63bda6cec9e3e374be58e577da1a31b6c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/new\/info%2ebak",
"request_line": "GET \/config\/new\/info%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/new\/info%2ebak",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/new\/info%2ebak",
"request_line": "GET \/config\/new\/info%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/new\/info%2ebak",
"evidence_snippet": "GET \/config\/new\/info%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /proton/config%2ejson
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /proton/config%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/proton/config%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/proton/config%2ejson
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /proton/config%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /proton/config%2ejson HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /proton/config%2ejson HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "d4f6440b660c6cdbd4c0c3af9de11e180ea7e538",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.145591839428685,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "4a69dabb80e6bdb256e05f8551219d447c651b54",
"event_fingerprint": "0532ede4b24a9b09b556030b1d016aa632d4ecb0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4d1596971de07a78994060f391e83b5b",
"path_pattern_hash": "2cec9eb00d33b651a11063d144bf4042"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/proton\/config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/proton\/config%2ejson HTTP\/1.1",
"request_sample": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/proton\/config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/proton\/config%2ejson HTTP\/1.1",
"request_sample": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b083036b0aa055235ebba34a6ee32a585b76122e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/proton\/config%2ejson",
"request_line": "GET \/proton\/config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/proton\/config%2ejson",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/proton\/config%2ejson",
"request_line": "GET \/proton\/config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/proton\/config%2ejson",
"evidence_snippet": "GET \/proton\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /services/redis-commander/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /services/redis-commander/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/services/redis-commander/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/services/redis-commander/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /services/redis-commander/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /services/redis-commander/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /services/redis-commander/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "dc0d63202301735bafca0f9cf52826682a3d2ca6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 395,
"payload_entropy": 5.155984305702597,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "f645b80210ae42fbda81ab708d5f6106f502d91d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "95eb5653411e8c06a46363753879a98b",
"path_pattern_hash": "ee796e834696fb4646cbef35e9049022"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"method": "GET",
"path": "\/services\/redis-commander\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1",
"request_sample": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 1",
"payload_snippet": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/services\/redis-commander\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1",
"request_sample": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 1",
"payload_snippet": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf353572e77132711e72984a3e1d32478f2ece9a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/redis-commander\/%2eenv",
"request_line": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/redis-commander\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/redis-commander\/%2eenv",
"request_line": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/redis-commander\/%2eenv",
"evidence_snippet": "GET \/services\/redis-commander\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /_asterisk/zizo/config%2ephp
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /_asterisk/zizo/config%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/_asterisk/zizo/config%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/_asterisk/zizo/config%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /_asterisk/zizo/config%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /_asterisk/zizo/config%2ephp HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Ac
Requête brute (extrait)
GET /_asterisk/zizo/config%2ephp HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "cece136bbac5ec9ff14e88550a65e7e54a253bb0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 391,
"payload_entropy": 5.182459001565556,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "4a69dabb80e6bdb256e05f8551219d447c651b54",
"event_fingerprint": "ee8ad1a6df3b4cd04e61e088b11c64e6d7c9484b",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "bbefc0b1e628d6425ee59025a2a6a63e",
"path_pattern_hash": "b76300c374348071d8324f926262ff58"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"method": "GET",
"path": "\/_asterisk\/zizo\/config%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1",
"request_sample": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"evidence": {
"method": "GET",
"path": "\/_asterisk\/zizo\/config%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1",
"request_sample": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c841a12e9d9b8b2d138f15484ddb47912f505399",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_asterisk\/zizo\/config%2ephp",
"request_line": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_asterisk\/zizo\/config%2ephp",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_asterisk\/zizo\/config%2ephp",
"request_line": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_asterisk\/zizo\/config%2ephp",
"evidence_snippet": "GET \/_asterisk\/zizo\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /api/keys/site%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/keys/site%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/api/keys/site%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/api/keys/site%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/keys/site%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/keys/site%2ebak HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /api/keys/site%2ebak HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "79fe9102ee5a29ce8f1776827e0a7735bdfa65c8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.160742455664492,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "5333825c2fc2271864ec4358831cb784df540c6e",
"event_fingerprint": "7a35f826b0f962bc72cb5e77db16a4cbd2f0d2b3",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "70575eeee7a519b956c4f9125b8c72f8",
"path_pattern_hash": "9ad1f8b89050f30855421e271cc0280e"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/api\/keys\/site%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/keys\/site%2ebak HTTP\/1.1",
"request_sample": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/api\/keys\/site%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/keys\/site%2ebak HTTP\/1.1",
"request_sample": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b379c631429d23c9115b5f99bbe51466aaf171e9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/keys\/site%2ebak",
"request_line": "GET \/api\/keys\/site%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/keys\/site%2ebak",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/keys\/site%2ebak",
"request_line": "GET \/api\/keys\/site%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/keys\/site%2ebak",
"evidence_snippet": "GET \/api\/keys\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /helm/values-service%2eyaml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /helm/values-service%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/helm/values-service%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/helm/values-service%2eyaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /helm/values-service%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /helm/values-service%2eyaml HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acc
Requête brute (extrait)
GET /helm/values-service%2eyaml HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "17ebd4a5c377a544574ecee91d76f53a2751759d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 390,
"payload_entropy": 5.182549141959143,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "e4fc7bcdf4beade9060eeac2de64cfe93d2a4bc4",
"event_fingerprint": "eaeeb16f803883dfa9bf22875c03ecbc894bcb5b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ac11961a19d31d35fded7529120b8178",
"path_pattern_hash": "d1871a62c80be241fdd35382b2946b56"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"method": "GET",
"path": "\/helm\/values-service%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/helm\/values-service%2eyaml HTTP\/1.1",
"request_sample": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/helm\/values-service%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/helm\/values-service%2eyaml HTTP\/1.1",
"request_sample": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "01f8baa7317686fc1f75c53467dad57c5c060683",
"protocol_details": {
"http_method": "GET",
"http_path": "\/helm\/values-service%2eyaml",
"request_line": "GET \/helm\/values-service%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/helm\/values-service%2eyaml",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/helm\/values-service%2eyaml",
"request_line": "GET \/helm\/values-service%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/helm\/values-service%2eyaml",
"evidence_snippet": "GET \/helm\/values-service%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_helm_probe",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /core/secrets/test%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /core/secrets/test%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/core/secrets/test%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/core/secrets/test%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/secrets/test%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /core/secrets/test%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /core/secrets/test%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "e99af66c77d48c04b44d2232bf09b29c73047f76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.121161009173607,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "63a6922768e0fee77bd71ff43299eb8d090d39f7",
"event_fingerprint": "34057c7e8ecaa9ee2b005541438ce0cbfcdda756",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a267b09af919592c86b87d6323de3479",
"path_pattern_hash": "3e67d9b0be5ff071cdb10d2e1b2ee6cb"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/core\/secrets\/test%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/secrets\/test%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/core\/secrets\/test%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/secrets\/test%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54d81e991de4bb83d332028009f6c6bfd61211d1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/secrets\/test%2eenv",
"request_line": "GET \/core\/secrets\/test%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/secrets\/test%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/secrets\/test%2eenv",
"request_line": "GET \/core\/secrets\/test%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/secrets\/test%2eenv",
"evidence_snippet": "GET \/core\/secrets\/test%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_k8s_probe",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /cloud/aws_key%2epem
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /cloud/aws_key%2epem UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/cloud/aws_key%2epem
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/cloud/aws_key%2epem
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /cloud/aws_key%2epem HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /cloud/aws_key%2epem HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /cloud/aws_key%2epem HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "1e09999dd0f689b22bfde2e27b57ae76110cf4dd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.175350791661187,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "2668673d42acde2c8a1bd5d33ca143bdef567d64",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d6b6d1b8325458e0687c351fbced526d",
"path_pattern_hash": "e80149a795981b3917b626e08d282e39"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/cloud\/aws_key%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cloud\/aws_key%2epem HTTP\/1.1",
"request_sample": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/cloud\/aws_key%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cloud\/aws_key%2epem HTTP\/1.1",
"request_sample": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79a5db4a7417507ed1010bc5e440046e457388ad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cloud\/aws_key%2epem",
"request_line": "GET \/cloud\/aws_key%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cloud\/aws_key%2epem",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cloud\/aws_key%2epem",
"request_line": "GET \/cloud\/aws_key%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cloud\/aws_key%2epem",
"evidence_snippet": "GET \/cloud\/aws_key%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /debug%2esql%2ezip
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /debug%2esql%2ezip UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/debug%2esql%2ezip
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/debug%2esql%2ezip
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /debug%2esql%2ezip HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /debug%2esql%2ezip HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /debug%2esql%2ezip HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "e5227108cec4ede15a7ee8e73487c35a60599b5e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.150799733040696,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "6f510a059b2f70e557036cb6239118375b3e4658",
"event_fingerprint": "7ed9b172941d60ce7887b50e5dfa1fa52f88fe65",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ec9803df79e823d96651c08e62d05b75",
"path_pattern_hash": "99a871d97b2ddfd2bc72ed0382081941"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/debug%2esql%2ezip",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/debug%2esql%2ezip HTTP\/1.1",
"request_sample": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/debug%2esql%2ezip",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/debug%2esql%2ezip HTTP\/1.1",
"request_sample": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c8711cb8ac3c7ea0dbf00444763c6ee8b8cd5ec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/debug%2esql%2ezip",
"request_line": "GET \/debug%2esql%2ezip HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/debug%2esql%2ezip",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/debug%2esql%2ezip",
"request_line": "GET \/debug%2esql%2ezip HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/debug%2esql%2ezip",
"evidence_snippet": "GET \/debug%2esql%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /infra/keystore%2epfx
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /infra/keystore%2epfx UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/infra/keystore%2epfx
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/infra/keystore%2epfx
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /infra/keystore%2epfx HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /infra/keystore%2epfx HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /infra/keystore%2epfx HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "933f03347d47fecd6dcafbc32f1dcebfd98c009e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.1680390250705335,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "426b471356cce455634520848943ed317a7bf924",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "873b9401fcb7cfb0f15568eebfd527d2",
"path_pattern_hash": "bd850a4e2614e85729dc3be940c81c94"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/infra\/keystore%2epfx",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/infra\/keystore%2epfx HTTP\/1.1",
"request_sample": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/infra\/keystore%2epfx",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/infra\/keystore%2epfx HTTP\/1.1",
"request_sample": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1cba9951817b6afc89babfaf8fce7ca4734142e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/infra\/keystore%2epfx",
"request_line": "GET \/infra\/keystore%2epfx HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/infra\/keystore%2epfx",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/infra\/keystore%2epfx",
"request_line": "GET \/infra\/keystore%2epfx HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/infra\/keystore%2epfx",
"evidence_snippet": "GET \/infra\/keystore%2epfx HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /api/backup/users%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/backup/users%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/backup/users%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/api/backup/users%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/backup/users%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/backup/users%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /api/backup/users%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "7c1c2f55ce9801507f2c6ab5563af4f7ca67ef0d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.161917256001,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "7d8eda7bbc2b065e6dbe04863e8a7bf9e98ac645",
"event_fingerprint": "49b3a0939347d274cac455aae3eb303fdce08fc9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "15337b1f3a9c6aa9e330c09ffb78bd8d",
"path_pattern_hash": "595b4635efdb066b1ca05e6e63e21220"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/api\/backup\/users%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/backup\/users%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/api\/backup\/users%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/backup\/users%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b45ee4678391503cea7ecbab07e62f7fa0852b58",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/backup\/users%2eenv",
"request_line": "GET \/api\/backup\/users%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/backup\/users%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/backup\/users%2eenv",
"request_line": "GET \/api\/backup\/users%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/backup\/users%2eenv",
"evidence_snippet": "GET \/api\/backup\/users%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /admin/admin/config%2ephp
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/admin/config%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/admin/config%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/admin/admin/config%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/admin/config%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/admin/config%2ephp HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /admin/admin/config%2ephp HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "8ab1950a5c1b5b283eaaa9ad2371d751266ceb18",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.175138200233548,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "074bb7dffeb22a9b6f6c3ae49976280b5802008c",
"event_fingerprint": "b44b9bb463e705e69819f41e575afd0711b6e266",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dd0fca3ade008031c406ee778a89b93d",
"path_pattern_hash": "aeba9c5057925cf63338f9df68dcdb1b"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/admin\/admin\/config%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/admin\/config%2ephp HTTP\/1.1",
"request_sample": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/admin\/admin\/config%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/admin\/config%2ephp HTTP\/1.1",
"request_sample": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d3441ebbc778f657219d58c4b4f16eb72263394",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/admin\/config%2ephp",
"request_line": "GET \/admin\/admin\/config%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/admin\/config%2ephp",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/admin\/config%2ephp",
"request_line": "GET \/admin\/admin\/config%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/admin\/config%2ephp",
"evidence_snippet": "GET \/admin\/admin\/config%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /config/upload/site%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/upload/site%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/upload/site%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/config/upload/site%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/upload/site%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/upload/site%2ebak HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /config/upload/site%2ebak HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "6010034f8300729762bb24206cc4fa92a927e8cc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.166503424201355,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "41ba69c257f87c43a92af5962e342e26db099808",
"event_fingerprint": "61bc660353c03c81a24840fefe98041b5634d3dc",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7caa999de110e072f333e6ae8fdc9269",
"path_pattern_hash": "76a4676fceca2db91c0c28a57d267ea2"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/config\/upload\/site%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/upload\/site%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/config\/upload\/site%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/upload\/site%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa3b831f4252be862821a514bf187cb8f73ebd85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/upload\/site%2ebak",
"request_line": "GET \/config\/upload\/site%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/upload\/site%2ebak",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/upload\/site%2ebak",
"request_line": "GET \/config\/upload\/site%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/upload\/site%2ebak",
"evidence_snippet": "GET \/config\/upload\/site%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /backup%2ecpp
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /backup%2ecpp UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/backup%2ecpp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/backup%2ecpp
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backup%2ecpp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /backup%2ecpp HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /backup%2ecpp HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clie
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "f8bbb2709436c40258ad750ce69879ac837dcbdf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 376,
"payload_entropy": 5.138842026252531,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "64a6aa7d165f32102556e949d89d25f05adbde3c",
"event_fingerprint": "70f9258bc4c3fe7be7d10e9ca9cff70637a47119",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "afabdabcaa05d201a75fd36e79ff6f67",
"path_pattern_hash": "33c7ff1229ef15362a7571b4c7c80c8a"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: ",
"method": "GET",
"path": "\/backup%2ecpp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup%2ecpp HTTP\/1.1",
"request_sample": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/backup%2ecpp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup%2ecpp HTTP\/1.1",
"request_sample": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af91b81a30eeae155aef0a8f723b4827e1a87953",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup%2ecpp",
"request_line": "GET \/backup%2ecpp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup%2ecpp",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup%2ecpp",
"request_line": "GET \/backup%2ecpp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup%2ecpp",
"evidence_snippet": "GET \/backup%2ecpp HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /delivery-app/api/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /delivery-app/api/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/delivery-app/api/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/delivery-app/api/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /delivery-app/api/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /delivery-app/api/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /delivery-app/api/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "7d5d3a02f5bf7113795ba0c13e7870b862553dce",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.152747438874305,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "0e10c0b9319cfdd2b5cb4ff4ce506a8af694a5e8",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d5ea1b4b9db4092ffab1e8e44546140f",
"path_pattern_hash": "5053e0142ec15d383d8847b2c1cef01f"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/delivery-app\/api\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1",
"request_sample": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/delivery-app\/api\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1",
"request_sample": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "970ab5a1102cbad528f9119b87f805321b844d36",
"protocol_details": {
"http_method": "GET",
"http_path": "\/delivery-app\/api\/%2eenv",
"request_line": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/delivery-app\/api\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/delivery-app\/api\/%2eenv",
"request_line": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/delivery-app\/api\/%2eenv",
"evidence_snippet": "GET \/delivery-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /laravel/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /laravel/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/laravel/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/laravel/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /laravel/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /laravel/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /laravel/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "28e78e1265e1e3dbd3989095251688bfdcc952ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.131807471539252,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "ec34e8417133646c1c643214a6d1c2dbfc8b8053",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ca2d653505e1d691d649f9dd15d12857",
"path_pattern_hash": "9ac7274739c7273de756adf1789be340"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/laravel\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/laravel\/%2eenv HTTP\/1.1",
"request_sample": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/laravel\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/laravel\/%2eenv HTTP\/1.1",
"request_sample": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1ff7320d38a0b53da282146771a0b70dcc1fa43",
"protocol_details": {
"http_method": "GET",
"http_path": "\/laravel\/%2eenv",
"request_line": "GET \/laravel\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/laravel\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/laravel\/%2eenv",
"request_line": "GET \/laravel\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/laravel\/%2eenv",
"evidence_snippet": "GET \/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /secrets/aws_credentials%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /secrets/aws_credentials%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/secrets/aws_credentials%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/secrets/aws_credentials%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /secrets/aws_credentials%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /secrets/aws_credentials%2ejs HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
A
Requête brute (extrait)
GET /secrets/aws_credentials%2ejs HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "ab796b137002acd1440c4115c9115947b2a46718",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 392,
"payload_entropy": 5.15254789280893,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "84ecb8349583b996386bb9dd509e4488438d4525",
"event_fingerprint": "a0e8667a1034da935820263a7adb11cbd0934700",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "2084d3c02f1447eade4342d207c343f1",
"path_pattern_hash": "fcae15b086e58bcd00a77b4ac2b67dfd"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nA",
"method": "GET",
"path": "\/secrets\/aws_credentials%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1",
"request_sample": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.",
"payload_snippet": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nA",
"evidence": {
"method": "GET",
"path": "\/secrets\/aws_credentials%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1",
"request_sample": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.",
"payload_snippet": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nA",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10f32766a4468130edf6f5e60d4fb3d200e3797b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets\/aws_credentials%2ejs",
"request_line": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nA",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets\/aws_credentials%2ejs",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets\/aws_credentials%2ejs",
"request_line": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets\/aws_credentials%2ejs",
"evidence_snippet": "GET \/secrets\/aws_credentials%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nA",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_k8s_probe",
"http_probe_secrets",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /vue-app/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /vue-app/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/vue-app/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/vue-app/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /vue-app/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /vue-app/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /vue-app/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "8cf717005816619f2efa658f01502b5c3d77292f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.132194107027038,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "4067831eeab13c54730f06ed42c28bbf007706e4",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "49cd046480b8071c2cbdcf864139f28c",
"path_pattern_hash": "c63b18c5d20e6d7b749bb3bb5530f759"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/vue-app\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/vue-app\/%2eenv HTTP\/1.1",
"request_sample": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/vue-app\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/vue-app\/%2eenv HTTP\/1.1",
"request_sample": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "101700d35e814ce9bb1355fafe2388728e5387ae",
"protocol_details": {
"http_method": "GET",
"http_path": "\/vue-app\/%2eenv",
"request_line": "GET \/vue-app\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/vue-app\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/vue-app\/%2eenv",
"request_line": "GET \/vue-app\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/vue-app\/%2eenv",
"evidence_snippet": "GET \/vue-app\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /api/tmp/config%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/tmp/config%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/tmp/config%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/api/tmp/config%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/tmp/config%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/tmp/config%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /api/tmp/config%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "9f90f9e7cd1b5a4c7358bb29d0e28a5469b210d8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.1588784058125245,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "6db457d5ee1bd5585c56341f67ab09b0cb3b720a",
"event_fingerprint": "8ce0aebb080ec2d2e70bf80ec6301f851d903f76",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e3306ece42e4df235c88d451dcc82a26",
"path_pattern_hash": "0169e99888ba50a620ac3cd959578bf6"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/api\/tmp\/config%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/tmp\/config%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/api\/tmp\/config%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/tmp\/config%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3e816ce9bba61a699caa474c1f5c4741cde5ad7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/tmp\/config%2eenv",
"request_line": "GET \/api\/tmp\/config%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/tmp\/config%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/tmp\/config%2eenv",
"request_line": "GET \/api\/tmp\/config%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/tmp\/config%2eenv",
"evidence_snippet": "GET \/api\/tmp\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /admin/server%2epem
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /admin/server%2epem UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/server%2epem
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/admin/server%2epem
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/server%2epem HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/server%2epem HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /admin/server%2epem HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "15958f56ec92a3f13d19c8d8283c611fe584c33b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.147421584300924,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "4f073bc3e03e0525454121202f98fdf8a018444d",
"event_fingerprint": "e48894e1876bd8760e4c7cf0f81830082f4ea6b6",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d5ed4ba8a04dd603d6eed555b88574a4",
"path_pattern_hash": "da017307a7ad016799591615dbfb378f"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/admin\/server%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/server%2epem HTTP\/1.1",
"request_sample": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/admin\/server%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/server%2epem HTTP\/1.1",
"request_sample": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41279a73e4ec19e9f83ff36a527378f4a927035f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/server%2epem",
"request_line": "GET \/admin\/server%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/server%2epem",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/server%2epem",
"request_line": "GET \/admin\/server%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/server%2epem",
"evidence_snippet": "GET \/admin\/server%2epem HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /config/email/ses%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/email/ses%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/email/ses%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/config/email/ses%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/email/ses%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/email/ses%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /config/email/ses%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "a05a864ca306191ec64492c4422b36980f60a826",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.158352020554652,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "a102dbf542954187d6bc0a80a5bd145e56159e2b",
"event_fingerprint": "7ecc449319a67d7ebad054648601fbbcbd2284a6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6e0e8364f1e2981d048798f222d07f27",
"path_pattern_hash": "7234766fba3915d57a714f14ab9ef22d"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/config\/email\/ses%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/email\/ses%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/config\/email\/ses%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/email\/ses%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99e796959cb91cc3f53182b155ed2097ff8889b9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/email\/ses%2eenv",
"request_line": "GET \/config\/email\/ses%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/email\/ses%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/email\/ses%2eenv",
"request_line": "GET \/config\/email\/ses%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/email\/ses%2eenv",
"evidence_snippet": "GET \/config\/email\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /dump%2emongodump%2egz
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /dump%2emongodump%2egz UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/dump%2emongodump%2egz
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/dump%2emongodump%2egz
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /dump%2emongodump%2egz HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /dump%2emongodump%2egz HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /dump%2emongodump%2egz HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "97faedc58e0f1576590d4b0e0b4cea5a0bc5b44f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.160922329316401,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "1dff7fa03425796d4e9f8b04b71ad2dda45f54e5",
"event_fingerprint": "1e7279ee4b8afa9e700ebb52cb1f3f87205d5394",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e88ef520d66a9f80e887b7374ba8a697",
"path_pattern_hash": "ba1981a06d90748e7b61acde706ce9fd"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/dump%2emongodump%2egz",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/dump%2emongodump%2egz HTTP\/1.1",
"request_sample": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/dump%2emongodump%2egz",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/dump%2emongodump%2egz HTTP\/1.1",
"request_sample": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ed35f5290cc1d6aefa9e2bdab77b0cabe6439d5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dump%2emongodump%2egz",
"request_line": "GET \/dump%2emongodump%2egz HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dump%2emongodump%2egz",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/dump%2emongodump%2egz",
"request_line": "GET \/dump%2emongodump%2egz HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dump%2emongodump%2egz",
"evidence_snippet": "GET \/dump%2emongodump%2egz HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /callback/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /callback/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/callback/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/callback/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /callback/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /callback/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /callback/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "3526f66b0f271e0470c55a60c0e965e4de78f17a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.147946046821462,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "f9c90fe5bfe46f1eecd2f3b4c65348767468f0d2",
"event_fingerprint": "c8f6b3819cb7e24c9526b902584d3b5046050fba",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "18d044ec5f891407bde112a783ecb0ab",
"path_pattern_hash": "248f041ff3e8e79f4d618dc4f14f527f"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/callback\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/callback\/%2eenv HTTP\/1.1",
"request_sample": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/callback\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/callback\/%2eenv HTTP\/1.1",
"request_sample": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df9fe455028a2cac69f498aa16d3cd38c1e531f6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/callback\/%2eenv",
"request_line": "GET \/callback\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/callback\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/callback\/%2eenv",
"request_line": "GET \/callback\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/callback\/%2eenv",
"evidence_snippet": "GET \/callback\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_callback",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /mailer/mail%2eyaml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /mailer/mail%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/mailer/mail%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/mailer/mail%2eyaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /mailer/mail%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /mailer/mail%2eyaml HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /mailer/mail%2eyaml HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "d6bb4c47e0d67499f453889b2ef23a1bad608c5c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.156511249661159,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "c7b19e0d815afc20ba17521902f79e015d5b3d07",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dd45f5aa34b0f1fc649e2a37088e40e9",
"path_pattern_hash": "a8993caad39f5953db417fd9db25a4cd"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/mailer\/mail%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mailer\/mail%2eyaml HTTP\/1.1",
"request_sample": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/mailer\/mail%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mailer\/mail%2eyaml HTTP\/1.1",
"request_sample": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c11c807c506b4caf55f08bc5a8f1f965c0efc88c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/mail%2eyaml",
"request_line": "GET \/mailer\/mail%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/mail%2eyaml",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/mail%2eyaml",
"request_line": "GET \/mailer\/mail%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/mail%2eyaml",
"evidence_snippet": "GET \/mailer\/mail%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /portal/%2eenv%2edist
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /portal/%2eenv%2edist UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/portal/%2eenv%2edist
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/portal/%2eenv%2edist
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /portal/%2eenv%2edist HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /portal/%2eenv%2edist HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /portal/%2eenv%2edist HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "13f8b92811b07e0edde1ea79a65a6d1d4831dc4e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.140445427853067,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "85ac02b03bf3fa3846d3a6bf631f898872766633",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "9376c75087d39b0e601acce1db6c8f42",
"path_pattern_hash": "9f0baad91d4ea120062bbdee981da61d"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/portal\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/portal\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/portal\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/portal\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1bad2985758b983084a7ad6da16e993fda922f74",
"protocol_details": {
"http_method": "GET",
"http_path": "\/portal\/%2eenv%2edist",
"request_line": "GET \/portal\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/%2eenv%2edist",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/portal\/%2eenv%2edist",
"request_line": "GET \/portal\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/%2eenv%2edist",
"evidence_snippet": "GET \/portal\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /%2ejenkins/hudson%2etasks%2eWasmMerge%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%2ejenkins/hudson%2etasks%2eWasmMerge%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/%2ejenkins/hudson%2etasks%2eWasmMerge%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/%2ejenkins/hudson%2etasks%2eWasmMerge%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2ejenkins/hudson%2etasks%2eWasmMerge%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /%2ejenkins/hudson%2etasks%2eWasmMerge%2exml HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-En
Requête brute (extrait)
GET /%2ejenkins/hudson%2etasks%2eWasmMerge%2exml HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "3c7aed5f5168983a51900d33dfca083604887104",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 407,
"payload_entropy": 5.229107090734461,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "d7aea948b41fb8a5eb718505cb41007071dadda8",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "fe94a3f1374d1dd481ad002fb349f134",
"path_pattern_hash": "2dcb68074d44edf3a4e6ba72e413fd1e"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-En",
"method": "GET",
"path": "\/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1",
"request_sample": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-",
"payload_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-En",
"evidence": {
"method": "GET",
"path": "\/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1",
"request_sample": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-",
"payload_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-En",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66fbb2f4b7c338e17d3efc78c675fda173556231",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml",
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-En",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml",
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml",
"evidence_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWasmMerge%2exml HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-En",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /%2evite/
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%2evite/ UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/%2evite/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/%2evite/
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2evite/ HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /%2evite/ HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-U
Requête brute (extrait)
GET /%2evite/ HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-I
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "40a11ea4a13f9e95861453eacf647e7387cf55f8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 372,
"payload_entropy": 5.1199766552832475,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "d9dd43e1a15b39e41bb5246b9654c960ab2c9b65",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "8cd08e68236a84675943a2e2641de16e",
"path_pattern_hash": "a149424a2e8630cc760c770bbef8110d"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"method": "GET",
"path": "\/%2evite\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2evite\/ HTTP\/1.1",
"request_sample": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"evidence": {
"method": "GET",
"path": "\/%2evite\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2evite\/ HTTP\/1.1",
"request_sample": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b0c4f20c933567c0c4d66863c1f296d4e965102",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2evite\/",
"request_line": "GET \/%2evite\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2evite\/",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2evite\/",
"request_line": "GET \/%2evite\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2evite\/",
"evidence_snippet": "GET \/%2evite\/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /var/www/html/mariadb/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /var/www/html/mariadb/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
45
Recommandation
Investiguer
Tags
950312:lfi-13
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/var/www/html/mariadb/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/var/www/html/mariadb/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-13 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /var/www/html/mariadb/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-13
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /var/www/html/mariadb/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Ac
Requête brute (extrait)
GET /var/www/html/mariadb/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "fb37016ea6e7ace9639b111815c229d6534ad3a6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 391,
"payload_entropy": 5.200582705966517,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "5f29748c2ad172e10ad85f7a5fb0a7e440401322",
"event_fingerprint": "2eca4a16375d844939e635816398c6ce6cb28d98",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "407af6844dbc4b98bbc9f4a44a4e5196",
"path_pattern_hash": "2b0d65beb5b90f77bb5767f06a3c85e1"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"method": "GET",
"path": "\/var\/www\/html\/mariadb\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950312:lfi-13",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-13",
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1",
"request_sample": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"evidence": {
"method": "GET",
"path": "\/var\/www\/html\/mariadb\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950312:lfi-13",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-13",
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1",
"request_sample": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08d1b7f5a7722e088c508dd679640999422bc26f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/html\/mariadb\/%2eenv",
"request_line": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/html\/mariadb\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/html\/mariadb\/%2eenv",
"request_line": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/html\/mariadb\/%2eenv",
"evidence_snippet": "GET \/var\/www\/html\/mariadb\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950312:lfi-13",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /config/repository%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/repository%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/repository%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/config/repository%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/repository%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/repository%2ejs HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /config/repository%2ejs HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "ff57f667c967bb87f574b271bb9202f75e9892d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.160555094107845,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "a102dbf542954187d6bc0a80a5bd145e56159e2b",
"event_fingerprint": "5b3c0d57ff498a2d7d94c229c214ec0cf73e52d0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "bb27cab8e5367af9699c6a85ab7f9c36",
"path_pattern_hash": "30e51eb5c0bc4d10aa603feaa057ed4b"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/config\/repository%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/repository%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/config\/repository%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/repository%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb0629db8f9aad5a63eeb09d84943af2c4623436",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/repository%2ejs",
"request_line": "GET \/config\/repository%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/repository%2ejs",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/repository%2ejs",
"request_line": "GET \/config\/repository%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/repository%2ejs",
"evidence_snippet": "GET \/config\/repository%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /%2eenv%2eorig
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eenv%2eorig UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950514:leak-1
951041:dns-rebind
Cible HTTP
GET
/%2eenv%2eorig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/%2eenv%2eorig
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eenv%2eorig HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eenv%2eorig HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /%2eenv%2eorig HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "b40ba2a44b68e9a39d14e7977dc214f21b6e3ef2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.123738418586945,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "2d5b51692da4285c5e61440094a9b5b8a609ea8a",
"event_fingerprint": "0805c8913b0ba6c1ed161bc3c5b77a97b8906112",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4ca3f489663dc503ddea9a358254e9c3",
"path_pattern_hash": "8bf5697a43b6e34df8b9489f416f53c8"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/%2eenv%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2eorig HTTP\/1.1",
"request_sample": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/%2eenv%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2eorig HTTP\/1.1",
"request_sample": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77188c7a55cb400142ab1b9bf44e285ad2a68e60",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2eorig",
"request_line": "GET \/%2eenv%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2eorig",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2eorig",
"request_line": "GET \/%2eenv%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2eorig",
"evidence_snippet": "GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:2001 · (tentative d'exploit) · → /server/config/config%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /server/config/config%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/server/config/config%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/server/config/config%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /server/config/config%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /server/config/config%2ejs HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /server/config/config%2ejs HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "3891bb2a3efaff69db1ed93a0b2bd7f527819f3c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.165068637652846,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b2c399c58cd4ad6786382f44f5633e18ca49f528",
"event_fingerprint": "2c2bc5dfc5e79196b720b1e71f243e8fd7faabec",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "726be8520f865f4e511868ffa1c26661",
"path_pattern_hash": "a429c2e6cfdf7c74a38e17857f1e6a82"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/server\/config\/config%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/server\/config\/config%2ejs HTTP\/1.1",
"request_sample": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/server\/config\/config%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/server\/config\/config%2ejs HTTP\/1.1",
"request_sample": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b492d16da3c8d6309e98e2d2be4491ef3182780",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/config\/config%2ejs",
"request_line": "GET \/server\/config\/config%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/config\/config%2ejs",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/config\/config%2ejs",
"request_line": "GET \/server\/config\/config%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/config\/config%2ejs",
"evidence_snippet": "GET \/server\/config\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:2001 · (tentative d'exploit) · → /middleware/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /middleware/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/middleware/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2001
Chemin / cible
/middleware/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /middleware/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /middleware/%2eenv HTTP/1.1
Host: 62.3.50.33:2001
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /middleware/%2eenv HTTP/1.1 Host: 62.3.50.33:2001 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "b99d6b4082fdd9f19dfa6934ccb6ce8e9b69d286",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.14352381644557,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "334579126dec1d77d7302e8c84882fe1e69a2783",
"event_fingerprint": "14f178152cbab995080573175aa55e565b8d8c82",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d537c7d642f5f7118d1b9c57ac353383",
"path_pattern_hash": "9a36a016bcfd04458a9b1c800677cd4d"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/middleware\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/middleware\/%2eenv HTTP\/1.1",
"request_sample": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/middleware\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/middleware\/%2eenv HTTP\/1.1",
"request_sample": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a58b858c9e0ba1750dbc0b4c9c9325c66bed1b23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/middleware\/%2eenv",
"request_line": "GET \/middleware\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/middleware\/%2eenv",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/middleware\/%2eenv",
"request_line": "GET \/middleware\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/middleware\/%2eenv",
"evidence_snippet": "GET \/middleware\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|