|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /_nodes/http
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /_nodes/http UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/_nodes/http
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/_nodes/http
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ES nodes API
Ligne de requête
GET /_nodes/http HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /_nodes/http HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /_nodes/http HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "ff6b945c65ec0157356b158dad63a07259b32811",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.138372964776699,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "f50af6971a8c58cafa2116b2770ef58814a264e3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340",
"pat-0344"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ES nodes API"
],
"pattern_ids": [
"pat-0340",
"pat-0344"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "15f15388bbd339fb837ca774a69b2ff5",
"path_pattern_hash": "0b56a35fea8ce0b7c79004682198e73c"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/_nodes\/http",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_nodes\/http HTTP\/1.1",
"request_sample": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/_nodes\/http",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_nodes\/http HTTP\/1.1",
"request_sample": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1f848e44843fbfe5e751fe0f1cc88e8f601587f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_nodes\/http",
"request_line": "GET \/_nodes\/http HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_nodes\/http",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_nodes\/http",
"request_line": "GET \/_nodes\/http HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_nodes\/http",
"evidence_snippet": "GET \/_nodes\/http HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /info/%2eenv%2edist
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /info/%2eenv%2edist UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/info/%2eenv%2edist
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/info/%2eenv%2edist
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /info/%2eenv%2edist HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /info/%2eenv%2edist HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /info/%2eenv%2edist HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "59b558da015d01f2939764f8733c9dbe19cf209a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.150566824829022,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "590bd59ea4b3ffc0801dd50a8db3e05521e43d7e",
"event_fingerprint": "a1a25ab45e41279d328b7304abcb2a4b57c127ec",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7f66237a6296cd74534c595d6c950a7f",
"path_pattern_hash": "31e472d70f7d655171121b123169ef03"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/info\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/info\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/info\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/info\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc16f410783af5b464aefda31d6e404e8a463c2f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/info\/%2eenv%2edist",
"request_line": "GET \/info\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/info\/%2eenv%2edist",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/info\/%2eenv%2edist",
"request_line": "GET \/info\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/info\/%2eenv%2edist",
"evidence_snippet": "GET \/info\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /config/sql/login%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sql/login%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/sql/login%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/config/sql/login%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/sql/login%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/sql/login%2ebak HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /config/sql/login%2ebak HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "76492cdd4ca7da756b3e84beba8e5086c1d473f4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.172919844733428,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "1c4b3fa62e104514d9494995da33f4427ab8cf7c",
"event_fingerprint": "af6a028353a2e2caed65cf445b85f295d28d8e3e",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "71d87085e9063ec5fa506da5314e4a1d",
"path_pattern_hash": "dbd52cceaf86f6df85e7584a176672f8"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/config\/sql\/login%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/sql\/login%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/config\/sql\/login%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/sql\/login%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ede86773480f96129810d34cc68a5705479b3e8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sql\/login%2ebak",
"request_line": "GET \/config\/sql\/login%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sql\/login%2ebak",
"request_line": "GET \/config\/sql\/login%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak",
"evidence_snippet": "GET \/config\/sql\/login%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /aws%2ephp%2eold
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /aws%2ephp%2eold UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950521:leak-8
951041:dns-rebind
Cible HTTP
GET
/aws%2ephp%2eold
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/aws%2ephp%2eold
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /aws%2ephp%2eold HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /aws%2ephp%2eold HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /aws%2ephp%2eold HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "7387bb51d5104b879d0e99dc9944d1ea1af5fb99",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.152542176500793,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "4eba704b072f1c864e6e3389f6103d1b66579482",
"event_fingerprint": "059a9e281a796175073d246f58cf06b3ab92a482",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "73bbf21c6c9bf114e2ce37a9104fc6b8",
"path_pattern_hash": "3363573a2f1d6e8551aac742e2f1bbd7"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/aws%2ephp%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/aws%2ephp%2eold HTTP\/1.1",
"request_sample": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/aws%2ephp%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/aws%2ephp%2eold HTTP\/1.1",
"request_sample": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc56416e448bd1d1c8c743aef8f40a630fa76295",
"protocol_details": {
"http_method": "GET",
"http_path": "\/aws%2ephp%2eold",
"request_line": "GET \/aws%2ephp%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/aws%2ephp%2eold",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/aws%2ephp%2eold",
"request_line": "GET \/aws%2ephp%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/aws%2ephp%2eold",
"evidence_snippet": "GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /private/ses%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /private/ses%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/private/ses%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/private/ses%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /private/ses%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /private/ses%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /private/ses%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "f47395e56d3d527db1e3f890f0c3e5ff743b1c96",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.139722314256706,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "7e53b979575cd228c7991b7c9c12ce2c33bd217e",
"event_fingerprint": "ecef751b5a1e19e42033ac5e8f0e4c71b1bbbfb9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3c25f06b16f0dba80fc37abb536746a4",
"path_pattern_hash": "e3edf72b89e306a325c47fe5b53531f3"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/private\/ses%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/private\/ses%2eenv HTTP\/1.1",
"request_sample": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/private\/ses%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/private\/ses%2eenv HTTP\/1.1",
"request_sample": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3851cd1a0162ab3aa6cf3890138855cc886c874d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/ses%2eenv",
"request_line": "GET \/private\/ses%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/ses%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/ses%2eenv",
"request_line": "GET \/private\/ses%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/ses%2eenv",
"evidence_snippet": "GET \/private\/ses%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_private",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /wp-admin/network/ms-plugins%2ephp
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-admin/network/ms-plugins%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
32
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950503:cms-1
Cible HTTP
GET
/wp-admin/network/ms-plugins%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/wp-admin/network/ms-plugins%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-admin/network/ms-plugins%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cms-1
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-admin/network/ms-plugins%2ephp HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gz
Requête brute (extrait)
GET /wp-admin/network/ms-plugins%2ephp HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP:
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "d0604bd294cc12c0955a581beca19967e6c52875",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 397,
"payload_entropy": 5.18791664243248,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "9def3fa62b224bf83523f63d6142a34307b8048e",
"event_fingerprint": "322b03c7feeb618f7c47464ca46f8e4bd74f7486",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "2770c77631ac9db590ee96235aebf6cd",
"path_pattern_hash": "e122959fd1e06d1c49586e746fa1e004"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gz",
"method": "GET",
"path": "\/wp-admin\/network\/ms-plugins%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950503:cms-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1",
"request_sample": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP:",
"payload_snippet": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gz",
"evidence": {
"method": "GET",
"path": "\/wp-admin\/network\/ms-plugins%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950503:cms-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1",
"request_sample": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP:",
"payload_snippet": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gz",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86919d4a60f1bef369e9673672fe10efd24da5fd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-admin\/network\/ms-plugins%2ephp",
"request_line": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gz",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-admin\/network\/ms-plugins%2ephp",
"request_line": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp",
"evidence_snippet": "GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gz",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950503:cms-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /decode%2ephp%2eold
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /decode%2ephp%2eold UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950521:leak-8
951041:dns-rebind
Cible HTTP
GET
/decode%2ephp%2eold
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/decode%2ephp%2eold
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /decode%2ephp%2eold HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /decode%2ephp%2eold HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /decode%2ephp%2eold HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "9176492dea225c37afe64355a4573bac33b15403",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.14154049095701,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "4eba704b072f1c864e6e3389f6103d1b66579482",
"event_fingerprint": "ffb21590d755bfed168f0ffa53a16167ff6b1c90",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "1c27559b1488db85764c76d96be9eb84",
"path_pattern_hash": "32feccaba1604e74f0afb6a05e1e09fe"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/decode%2ephp%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/decode%2ephp%2eold HTTP\/1.1",
"request_sample": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/decode%2ephp%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/decode%2ephp%2eold HTTP\/1.1",
"request_sample": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "653f94de781fd1660290a18eed0ab332103d4e18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/decode%2ephp%2eold",
"request_line": "GET \/decode%2ephp%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/decode%2ephp%2eold",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/decode%2ephp%2eold",
"request_line": "GET \/decode%2ephp%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/decode%2ephp%2eold",
"evidence_snippet": "GET \/decode%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /admin/tmp/settings%2ejson
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/tmp/settings%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/tmp/settings%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/admin/tmp/settings%2ejson
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/tmp/settings%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/tmp/settings%2ejson HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /admin/tmp/settings%2ejson HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "8570f8553126c3d30f053cbaf09c38af8a38a09a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.166468568253951,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "d9d4a86ce8667da8b74b9ec4d0617774e126cdc7",
"event_fingerprint": "6de036b7c940298da344e10875853e8c91f9d9e9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "718bfd10b929e6a66527db1249716838",
"path_pattern_hash": "018008c41ceedeb260bc2b30df63430d"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/admin\/tmp\/settings%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1",
"request_sample": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/admin\/tmp\/settings%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1",
"request_sample": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fad26e4a42fbc181d4fa98f09bec8f8a19d51c2a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/tmp\/settings%2ejson",
"request_line": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/tmp\/settings%2ejson",
"request_line": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson",
"evidence_snippet": "GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api-key_cloudfront%2etxt
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api-key_cloudfront%2etxt UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/api-key_cloudfront%2etxt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api-key_cloudfront%2etxt
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api-key_cloudfront%2etxt HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /api-key_cloudfront%2etxt HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /api-key_cloudfront%2etxt HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "b780fe5356382fdf7dadb1e9cfa6adc3341b7fad",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.179156969883991,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "818d0dfc65d8d9f48e3a9f110d18ef6705113eaa",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "238b93399c8a41432cc9a15ab9245649",
"path_pattern_hash": "c8c4be3a6a7f473bb92f01164b059b48"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/api-key_cloudfront%2etxt",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api-key_cloudfront%2etxt HTTP\/1.1",
"request_sample": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/api-key_cloudfront%2etxt",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api-key_cloudfront%2etxt HTTP\/1.1",
"request_sample": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "537854da83144a85a53806e28a316af9c7d551b8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api-key_cloudfront%2etxt",
"request_line": "GET \/api-key_cloudfront%2etxt HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api-key_cloudfront%2etxt",
"request_line": "GET \/api-key_cloudfront%2etxt HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt",
"evidence_snippet": "GET \/api-key_cloudfront%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /core/secrets/config%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /core/secrets/config%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/core/secrets/config%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/core/secrets/config%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/secrets/config%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /core/secrets/config%2ejs HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /core/secrets/config%2ejs HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "09d6a4c994c1f2cff7878cfe15a3080286fbe608",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.148425617276179,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "1c710f669e7ff98ac77d98025003188fe9d13197",
"event_fingerprint": "e39b2c83a171c9d1e58c60690a40e7431d5ffdbb",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "cd5da6a7dc3c5f5d07abcdbc631e2205",
"path_pattern_hash": "85810599d11150068ef74d98ae0af279"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/core\/secrets\/config%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/secrets\/config%2ejs HTTP\/1.1",
"request_sample": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/core\/secrets\/config%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/secrets\/config%2ejs HTTP\/1.1",
"request_sample": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9add692aabafa8518229a320ab458a43098ff7e2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/secrets\/config%2ejs",
"request_line": "GET \/core\/secrets\/config%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/secrets\/config%2ejs",
"request_line": "GET \/core\/secrets\/config%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs",
"evidence_snippet": "GET \/core\/secrets\/config%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_k8s_probe",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /test_phpinfo5%2ephp
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /test_phpinfo5%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/test_phpinfo5%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/test_phpinfo5%2ephp
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /test_phpinfo5%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /test_phpinfo5%2ephp HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /test_phpinfo5%2ephp HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "f203492862c6fba6dff438691931b373b1815a97",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.176096948017317,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "bf130f20d6451523b6019395cc1fe446ad4135e5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a7c91c17f94301db4a7d10d6064adc5a",
"path_pattern_hash": "a88015c2c876b7ff39d555606930e0ce"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/test_phpinfo5%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/test_phpinfo5%2ephp HTTP\/1.1",
"request_sample": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/test_phpinfo5%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/test_phpinfo5%2ephp HTTP\/1.1",
"request_sample": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f5d58fc7c3ded63f8ebbe92e15025e7e0e1e51a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/test_phpinfo5%2ephp",
"request_line": "GET \/test_phpinfo5%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/test_phpinfo5%2ephp",
"request_line": "GET \/test_phpinfo5%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp",
"evidence_snippet": "GET \/test_phpinfo5%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api/sendgrid_config%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/sendgrid_config%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/sendgrid_config%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api/sendgrid_config%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/sendgrid_config%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/sendgrid_config%2ejson HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acc
Requête brute (extrait)
GET /api/sendgrid_config%2ejson HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "2155bd174d1ed45ee2ef50cf65e7c826d5a33ee1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 390,
"payload_entropy": 5.172833148270664,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "3ea53a6f52f3d418bec2432daa9ec62bbf21177b",
"event_fingerprint": "ff7b0808125aed4009cc23e06e05a49e5c6d600e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "67a7e5d01bdba4b821f8f4fc6ed3c079",
"path_pattern_hash": "a4039cc7a913ca3c84f0aa59da2f6b35"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"method": "GET",
"path": "\/api\/sendgrid_config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1",
"request_sample": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/api\/sendgrid_config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1",
"request_sample": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2788e544dfbaeb57bfe606e748dc3febb0bf51f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/sendgrid_config%2ejson",
"request_line": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/sendgrid_config%2ejson",
"request_line": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson",
"evidence_snippet": "GET \/api\/sendgrid_config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /admin/static/debug%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/static/debug%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/static/debug%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/admin/static/debug%2eenv
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/static/debug%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/static/debug%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /admin/static/debug%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "62d03db252b7920658fe8de4c5e9c5acd4a1809d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.167359276464405,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "d9d4a86ce8667da8b74b9ec4d0617774e126cdc7",
"event_fingerprint": "5ce3a0d4b614b169bf25d0b60b371a4e781c9b6b",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dd8e9a54d604a564487f9d13b8946f00",
"path_pattern_hash": "dd4374e6396725b4a93e496ab548a1f2"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/admin\/static\/debug%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/static\/debug%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/admin\/static\/debug%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/static\/debug%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "184bfd3a1b362366f0d577a07a353b6522c9a032",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/static\/debug%2eenv",
"request_line": "GET \/admin\/static\/debug%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/static\/debug%2eenv",
"request_line": "GET \/admin\/static\/debug%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv",
"evidence_snippet": "GET \/admin\/static\/debug%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /src/debug%2elog
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/debug%2elog UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/src/debug%2elog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/src/debug%2elog
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941150
SSRF Localhost SSRF
Ligne de requête
GET /src/debug%2elog HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /src/debug%2elog HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /src/debug%2elog HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "d93981c8b7420d6138ccb6ef0557c8efcff682d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.14082779873588,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "0e1120ec7c6db06e1b4bb0eac3b486f52959b07f",
"event_fingerprint": "604fc7e7aab935d3e5e36d43464f46f9af77a17b",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0286",
"pat-0340"
],
"matched_pattern_names": [
"CRS 941150",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0286",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "db311b1ffb7b592dc14f3fc0817a068f",
"path_pattern_hash": "cda7cc188909acc4e69e36a80544397a"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/src\/debug%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/src\/debug%2elog HTTP\/1.1",
"request_sample": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/src\/debug%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/src\/debug%2elog HTTP\/1.1",
"request_sample": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e6d03cb737e5261a827c5be32f578e07b06842a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/debug%2elog",
"request_line": "GET \/src\/debug%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/debug%2elog",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/debug%2elog",
"request_line": "GET \/src\/debug%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/debug%2elog",
"evidence_snippet": "GET \/src\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /%2ejenkins/hudson%2etasks%2eSPirv%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%2ejenkins/hudson%2etasks%2eSPirv%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/%2ejenkins/hudson%2etasks%2eSPirv%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/%2ejenkins/hudson%2etasks%2eSPirv%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2ejenkins/hudson%2etasks%2eSPirv%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /%2ejenkins/hudson%2etasks%2eSPirv%2exml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encodi
Requête brute (extrait)
GET /%2ejenkins/hudson%2etasks%2eSPirv%2exml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Clie
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "541f35df5563d54455a41ef0d97f8cde41b7aff9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 403,
"payload_entropy": 5.222436565208068,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "bfa886fd174ed5d8de1c5bc0baedeeafe921887a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dee06919d61b5ad10980279b9171b35f",
"path_pattern_hash": "03603d0d578626744a99e336209572c9"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodi",
"method": "GET",
"path": "\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1",
"request_sample": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Clie",
"payload_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodi",
"evidence": {
"method": "GET",
"path": "\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1",
"request_sample": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Clie",
"payload_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ee185bcf9b51e6fbefcf11a6584d7168661cc02",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml",
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodi",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml",
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml",
"evidence_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodi",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /core/backup/db%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /core/backup/db%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/core/backup/db%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/core/backup/db%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/backup/db%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /core/backup/db%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /core/backup/db%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "25e87c690d67344e4c2c90367889c6f2c0981fc4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.164677306308583,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "af8270d6ca1906030b7c14a4ab78f46a750f8bd5",
"event_fingerprint": "f664075c179917af1a716e7ca01e0578ea56e617",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ad05b249fdbf17ca77f82ea5c2da6735",
"path_pattern_hash": "9003ac5eed01bdea8382e25df338ceeb"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/core\/backup\/db%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/backup\/db%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/core\/backup\/db%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/backup\/db%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e79efba483b84fe40488f2d853bb17a8bd75288",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/backup\/db%2eenv",
"request_line": "GET \/core\/backup\/db%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/backup\/db%2eenv",
"request_line": "GET \/core\/backup\/db%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv",
"evidence_snippet": "GET \/core\/backup\/db%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /tools/aws%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /tools/aws%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/tools/aws%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/tools/aws%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /tools/aws%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /tools/aws%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /tools/aws%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "651be48e9fdab6a7518117717db25429c13814f0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.143667394660672,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "741ba154c8b1340096950489ae100712e79e4e6b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "238386a8f646daa03d2635d48df325ba",
"path_pattern_hash": "c2d7238488913a3bf9ab8e03cfbee1e3"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/tools\/aws%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/tools\/aws%2eenv HTTP\/1.1",
"request_sample": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/tools\/aws%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/tools\/aws%2eenv HTTP\/1.1",
"request_sample": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e930e6a7a23cf4a2fdbdb15efe98dc2679859285",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tools\/aws%2eenv",
"request_line": "GET \/tools\/aws%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tools\/aws%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/tools\/aws%2eenv",
"request_line": "GET \/tools\/aws%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tools\/aws%2eenv",
"evidence_snippet": "GET \/tools\/aws%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api/public/config%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/public/config%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/public/config%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api/public/config%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/public/config%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/public/config%2exml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /api/public/config%2exml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "0384df45554daec98d08f86ba73f2432f210c731",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.186292415798445,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "98222c888ebca05334069a0636324ea59c3a9c54",
"event_fingerprint": "556b468b85156ab057df63fe1e2af634982ec8e4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6704aab20708c7a01df0476ba3357606",
"path_pattern_hash": "c66eae166966f1c8bc6680c13b79086c"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/api\/public\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/public\/config%2exml HTTP\/1.1",
"request_sample": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/api\/public\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/public\/config%2exml HTTP\/1.1",
"request_sample": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c873a821614c8a617ce679e777ce4a81c2ca613",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/public\/config%2exml",
"request_line": "GET \/api\/public\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/public\/config%2exml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/public\/config%2exml",
"request_line": "GET \/api\/public\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/public\/config%2exml",
"evidence_snippet": "GET \/api\/public\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /info4%2ephp
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /info4%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/info4%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/info4%2ephp
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /info4%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /info4%2ephp HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /info4%2ephp HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "5b799c4b6ebcc4b3a9438741142d022a47b5d659",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.157041594396653,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "d04db07ee29c84cf69b43e56018f74482d9b7ff2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c34d4b3fe718f23e822fd45481807849",
"path_pattern_hash": "aa6001943d9690d57e8a283353e2a677"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/info4%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/info4%2ephp HTTP\/1.1",
"request_sample": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/info4%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/info4%2ephp HTTP\/1.1",
"request_sample": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d29d44a722ec773fa0cea6ae29a627633a44f6aa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/info4%2ephp",
"request_line": "GET \/info4%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/info4%2ephp",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/info4%2ephp",
"request_line": "GET \/info4%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/info4%2ephp",
"evidence_snippet": "GET \/info4%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /admin/test/main%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/test/main%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/test/main%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/admin/test/main%2eenv
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/test/main%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/test/main%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /admin/test/main%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "2683a0217401eb0e58d5fe7eec10204f0e06c3a8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.154456725109238,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "d9d4a86ce8667da8b74b9ec4d0617774e126cdc7",
"event_fingerprint": "1c0ff1239c6707eab92491a8bdcfde6b77200b63",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3fc88a01adfaec3d0ddce3b842a36e86",
"path_pattern_hash": "11679f661efb536d80c1931b06526b9d"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/admin\/test\/main%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/test\/main%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/admin\/test\/main%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/test\/main%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64c543dc0e76cabdbd0ba1c401f6f3e3680e8ac2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/test\/main%2eenv",
"request_line": "GET \/admin\/test\/main%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/test\/main%2eenv",
"request_line": "GET \/admin\/test\/main%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv",
"evidence_snippet": "GET \/admin\/test\/main%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /%2eenv%2eexample-hotfix
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eenv%2eexample-hotfix UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950514:leak-1
951041:dns-rebind
Cible HTTP
GET
/%2eenv%2eexample-hotfix
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/%2eenv%2eexample-hotfix
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eenv%2eexample-hotfix HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eenv%2eexample-hotfix HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /%2eenv%2eexample-hotfix HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "743fece80801d4ea4cab1adf80ab535faee6f034",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.185141650043234,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "84036ba54da4cd5871094fa1b15721f41f138c5a",
"event_fingerprint": "d5278b51583af36f77f362f4c383cb2d5343af4b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "031e73e560b224149f631064684a6b2d",
"path_pattern_hash": "e4a000b7b4be6ad319c134450cae8196"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/%2eenv%2eexample-hotfix",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1",
"request_sample": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/%2eenv%2eexample-hotfix",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1",
"request_sample": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ab56157c57164c2718a33151455b189d83fe70b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2eexample-hotfix",
"request_line": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2eexample-hotfix",
"request_line": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix",
"evidence_snippet": "GET \/%2eenv%2eexample-hotfix HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /app/elasticemail%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/elasticemail%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/app/elasticemail%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/app/elasticemail%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /app/elasticemail%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /app/elasticemail%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /app/elasticemail%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "3ef7c947081c1beb4061bca77ba7b50faefd2e06",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.1521729311403845,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "e6ac902856298dc9306f8769721723a1c45b502b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5871d038414c3f9d86bd093817ad2c0c",
"path_pattern_hash": "360aadd960970cd36ff7d3e483dc7910"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/app\/elasticemail%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/elasticemail%2eenv HTTP\/1.1",
"request_sample": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/app\/elasticemail%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/elasticemail%2eenv HTTP\/1.1",
"request_sample": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6694168e2e7c2ab0a8ccc20e13cbf88d109336d3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/elasticemail%2eenv",
"request_line": "GET \/app\/elasticemail%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/elasticemail%2eenv",
"request_line": "GET \/app\/elasticemail%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv",
"evidence_snippet": "GET \/app\/elasticemail%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /portal/%2eenv%2eprod
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /portal/%2eenv%2eprod UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/portal/%2eenv%2eprod
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/portal/%2eenv%2eprod
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /portal/%2eenv%2eprod HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /portal/%2eenv%2eprod HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /portal/%2eenv%2eprod HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "093ebda3dedfdb4a0cf459c6463c195139c940a9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.143182193483721,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "590bd59ea4b3ffc0801dd50a8db3e05521e43d7e",
"event_fingerprint": "0a6b49477f0ea4b400aff1c062725b6bdf95b5fe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "456f35b839c8d0149878c5c5f92663ec",
"path_pattern_hash": "cdaa04f21ead530e229f84bd2ffd4513"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/portal\/%2eenv%2eprod",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/portal\/%2eenv%2eprod HTTP\/1.1",
"request_sample": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/portal\/%2eenv%2eprod",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/portal\/%2eenv%2eprod HTTP\/1.1",
"request_sample": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2cbbbfd6e25cbb9b6c59f6b8228090cd3ae872b1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/portal\/%2eenv%2eprod",
"request_line": "GET \/portal\/%2eenv%2eprod HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/portal\/%2eenv%2eprod",
"request_line": "GET \/portal\/%2eenv%2eprod HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod",
"evidence_snippet": "GET \/portal\/%2eenv%2eprod HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api/mail/smtp_credentials%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/mail/smtp_credentials%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/mail/smtp_credentials%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api/mail/smtp_credentials%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/mail/smtp_credentials%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/mail/smtp_credentials%2ejson HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzi
Requête brute (extrait)
GET /api/mail/smtp_credentials%2ejson HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP:
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "ecf190531f1d21f6ce40d24c8bad12751878839b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 396,
"payload_entropy": 5.186373027902807,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "3ea53a6f52f3d418bec2432daa9ec62bbf21177b",
"event_fingerprint": "4aa2bf0875922acf13660610664df558bc6f803d",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ba2f3bedb9cf5ed69897fe511d65db35",
"path_pattern_hash": "9d651ca2ea14b371bc67173f4063211e"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzi",
"method": "GET",
"path": "\/api\/mail\/smtp_credentials%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1",
"request_sample": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: ",
"payload_snippet": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzi",
"evidence": {
"method": "GET",
"path": "\/api\/mail\/smtp_credentials%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1",
"request_sample": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: ",
"payload_snippet": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a516a042bfcf1b8b9ebc246ceb2cf097eb34e878",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/mail\/smtp_credentials%2ejson",
"request_line": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzi",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/mail\/smtp_credentials%2ejson",
"request_line": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson",
"evidence_snippet": "GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzi",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /db%2emongodump
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /db%2emongodump UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/db%2emongodump
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/db%2emongodump
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /db%2emongodump HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /db%2emongodump HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /db%2emongodump HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "3c63a8750bc7c2b0a13eb48396b0f7eec9aab1e2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.158809257104951,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "c2109d6cee09c59810a926f344888f6861eeaefd",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5ed821cf1f7909718383d553f1a437e4",
"path_pattern_hash": "fc4dbf1424f0b82f0d46ec2a174d9965"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/db%2emongodump",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/db%2emongodump HTTP\/1.1",
"request_sample": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/db%2emongodump",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/db%2emongodump HTTP\/1.1",
"request_sample": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68c8f69f2dfd10c3c0c9d99cfa76b31381ae452a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/db%2emongodump",
"request_line": "GET \/db%2emongodump HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db%2emongodump",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/db%2emongodump",
"request_line": "GET \/db%2emongodump HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db%2emongodump",
"evidence_snippet": "GET \/db%2emongodump HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /application%2eproperties%2eorig
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /application%2eproperties%2eorig UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/application%2eproperties%2eorig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/application%2eproperties%2eorig
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /application%2eproperties%2eorig HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /application%2eproperties%2eorig HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /application%2eproperties%2eorig HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "477cda7c156ae739b0777b9d90df8fa17e6663d7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 395,
"payload_entropy": 5.133535587046074,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "4236595ccf4ba342816d82c0642268be16d68c21",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3f9469835f5a4e4b5a9c768f6f2095bd",
"path_pattern_hash": "3eaf164e6a8c4d1d5558c1b9873068ab"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"method": "GET",
"path": "\/application%2eproperties%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/application%2eproperties%2eorig HTTP\/1.1",
"request_sample": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 1",
"payload_snippet": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/application%2eproperties%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/application%2eproperties%2eorig HTTP\/1.1",
"request_sample": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 1",
"payload_snippet": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "246a172d01611cf621b851c5420d7eae38a781c1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application%2eproperties%2eorig",
"request_line": "GET \/application%2eproperties%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application%2eproperties%2eorig",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/application%2eproperties%2eorig",
"request_line": "GET \/application%2eproperties%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application%2eproperties%2eorig",
"evidence_snippet": "GET \/application%2eproperties%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api-key%2eyml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api-key%2eyml UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/api-key%2eyml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api-key%2eyml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api-key%2eyml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /api-key%2eyml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /api-key%2eyml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "b50e237670b086158a8da4c50204316dd18d6d25",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.155251266468309,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "05ea2e232fb86bcbf5336bac09bde56827796a57",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e05b9735f779bc7b8853c27417fad6fb",
"path_pattern_hash": "8dc423889a8bf4ff9ee47a1f73198c94"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/api-key%2eyml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api-key%2eyml HTTP\/1.1",
"request_sample": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/api-key%2eyml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api-key%2eyml HTTP\/1.1",
"request_sample": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "500275edda42c2bcde200d91509fc3f088b7748e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api-key%2eyml",
"request_line": "GET \/api-key%2eyml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api-key%2eyml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api-key%2eyml",
"request_line": "GET \/api-key%2eyml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api-key%2eyml",
"evidence_snippet": "GET \/api-key%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /terraform/terraform%2etfstate%2elock%2einfo%2e…
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /terraform/terraform%2etfstate%2elock%2einfo%2econf UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/terraform/terraform%2etfstate%2elock%2einfo%2econf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/terraform/terraform%2etfstate%2elock%2einfo%2econf
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /terraform/terraform%2etfstate%2elock%2einfo%2econf HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /terraform/terraform%2etfstate%2elock%2einfo%2econf HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Ac
Requête brute (extrait)
GET /terraform/terraform%2etfstate%2elock%2einfo%2econf HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "6fbf3fc997393cd26212322e66f14a1fe80724c9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 414,
"payload_entropy": 5.179469259255115,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "727423ae1d4ab5e0de150013b3a5aa7ca672ce25",
"event_fingerprint": "3c30d8ba205b4e9141d9a6d71214d4cdc45d5120",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "24849bc65c3e691f6e44f6b40bd43fcf",
"path_pattern_hash": "65f693b9dd982e63f572314c321f0714"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAc",
"method": "GET",
"path": "\/terraform\/terraform%2etfstate%2elock%2einfo%2econf",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1",
"request_sample": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.",
"payload_snippet": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAc",
"evidence": {
"method": "GET",
"path": "\/terraform\/terraform%2etfstate%2elock%2einfo%2econf",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1",
"request_sample": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.",
"payload_snippet": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db26c6b6f9b054cfacf65eea16bfd40c5199f20f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform\/terraform%2etfstate%2elock%2einfo%2econf",
"request_line": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAc",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform\/terraform%2etfstate%2elock%2einfo%2econf",
"request_line": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026",
"evidence_snippet": "GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAc",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_terraform",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /config/keys/config%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/keys/config%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/keys/config%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/config/keys/config%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/keys/config%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/keys/config%2exml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /config/keys/config%2exml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "b8dd950a420302c535d9efec2409fc43710b349a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.192128451937951,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "e4cc3bb6c53998552b8e022d80594a857143c6fe",
"event_fingerprint": "fb7a94eac5753a61d7706a30437ee40285d6601c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "61f3c98025ad2a812aa0a627ee5d9a21",
"path_pattern_hash": "71bb9e7055c0f5a6a3f2aa9af9f54af3"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/config\/keys\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/keys\/config%2exml HTTP\/1.1",
"request_sample": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/config\/keys\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/keys\/config%2exml HTTP\/1.1",
"request_sample": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af18f63983f671a6d7ae970c1617e6c5ea38d49f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/keys\/config%2exml",
"request_line": "GET \/config\/keys\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/keys\/config%2exml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/keys\/config%2exml",
"request_line": "GET \/config\/keys\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/keys\/config%2exml",
"evidence_snippet": "GET \/config\/keys\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api/config/sample%2elog
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/config/sample%2elog UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/config/sample%2elog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api/config/sample%2elog
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/config/sample%2elog HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/config/sample%2elog HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /api/config/sample%2elog HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "69e910deab36501fd3dadb45398d2e093d905c9e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.163524589003741,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "758ed1cfd7b452df2bdb76a9c4466d84922962e0",
"event_fingerprint": "35eaa6f76013a8455aa82bef6120f302450c8982",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "bbdec579a36e47a99271e2dea7a4067f",
"path_pattern_hash": "da152312ca3e7ae29c060a1dc480166f"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/api\/config\/sample%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/config\/sample%2elog HTTP\/1.1",
"request_sample": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/api\/config\/sample%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/config\/sample%2elog HTTP\/1.1",
"request_sample": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df61a569d8ae60b2ff6f986676b9e90d9d1e206c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config\/sample%2elog",
"request_line": "GET \/api\/config\/sample%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config\/sample%2elog",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config\/sample%2elog",
"request_line": "GET \/api\/config\/sample%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config\/sample%2elog",
"evidence_snippet": "GET \/api\/config\/sample%2elog HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /wp-content/backup/dbdump%2esql
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /wp-content/backup/dbdump%2esql UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/wp-content/backup/dbdump%2esql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/wp-content/backup/dbdump%2esql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-content/backup/dbdump%2esql HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-content/backup/dbdump%2esql HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /wp-content/backup/dbdump%2esql HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 12
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "dce844ddad552756948d90ddf939523f6ea20489",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 394,
"payload_entropy": 5.191732860576648,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "cb6a20f141e9b1e99138469b6f76bff19425f8a3",
"event_fingerprint": "f9a015960e88c2f158f323e6f685753ea509686c",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "75a273efc1bc79b95f3557a3e218503f",
"path_pattern_hash": "46401f3dea5961de30c238b6950848a9"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r",
"method": "GET",
"path": "\/wp-content\/backup\/dbdump%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1",
"request_sample": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 12",
"payload_snippet": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/wp-content\/backup\/dbdump%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1",
"request_sample": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 12",
"payload_snippet": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b42a8ea3d7f2af0d46bf32f91c8bc1605aff1a7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-content\/backup\/dbdump%2esql",
"request_line": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-content\/backup\/dbdump%2esql",
"request_line": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql",
"evidence_snippet": "GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /payment-app/api/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /payment-app/api/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/payment-app/api/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/payment-app/api/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /payment-app/api/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /payment-app/api/%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /payment-app/api/%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "5a2b53ab33b90300214cb62365a512ab49f441a6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.160616113129775,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "590bd59ea4b3ffc0801dd50a8db3e05521e43d7e",
"event_fingerprint": "517b52f167eaecaded188f44cd51d1a47d4a68fa",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0c3c5bc7731188d7a9b87edd9e14ccc4",
"path_pattern_hash": "5dd6ccc5ca99af94dc94d2ea0f2b77a5"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/payment-app\/api\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/payment-app\/api\/%2eenv HTTP\/1.1",
"request_sample": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/payment-app\/api\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/payment-app\/api\/%2eenv HTTP\/1.1",
"request_sample": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c623ea62028f3c10eddaa3fd9172b08a1b9d6c8d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/payment-app\/api\/%2eenv",
"request_line": "GET \/payment-app\/api\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/payment-app\/api\/%2eenv",
"request_line": "GET \/payment-app\/api\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv",
"evidence_snippet": "GET \/payment-app\/api\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /custom/%2eenv
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /custom/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/custom/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/custom/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /custom/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /custom/%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /custom/%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "83345ee7b16d1d2aa90988b373c2a7cb2bbaed12",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.145320099510883,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "590bd59ea4b3ffc0801dd50a8db3e05521e43d7e",
"event_fingerprint": "87a19fd23187975b1aeee24bc31d64e215e958a6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e5f1fc32e4d094889435d071d86abe7b",
"path_pattern_hash": "4e59106525e243287c9376964c3f2170"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/custom\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/custom\/%2eenv HTTP\/1.1",
"request_sample": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/custom\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/custom\/%2eenv HTTP\/1.1",
"request_sample": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff35020f415e1bb0b560ecb91865dd47b50dd9c5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/custom\/%2eenv",
"request_line": "GET \/custom\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/custom\/%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/custom\/%2eenv",
"request_line": "GET \/custom\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/custom\/%2eenv",
"evidence_snippet": "GET \/custom\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /new/info%2ephp
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /new/info%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/new/info%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/new/info%2ephp
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /new/info%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /new/info%2ephp HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /new/info%2ephp HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "3be98612c14adf93fb1cfe89830f0d980f09dbab",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.150025281189142,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "7bccd85328bd122ac0ac7f7d82d9f57cfaaf8832",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "b2e2ae9ee8f8c06b8768b29a3e4cf717",
"path_pattern_hash": "a7a9f5c2684b775940252b03aea345bb"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/new\/info%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/new\/info%2ephp HTTP\/1.1",
"request_sample": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/new\/info%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/new\/info%2ephp HTTP\/1.1",
"request_sample": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84ac91bf707ba4bf278c6a1ab5c6ab8daffeb5e4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/new\/info%2ephp",
"request_line": "GET \/new\/info%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/new\/info%2ephp",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/new\/info%2ephp",
"request_line": "GET \/new\/info%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/new\/info%2ephp",
"evidence_snippet": "GET \/new\/info%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /publics/%2egit/config
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /publics/%2egit/config UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950513:leak-0
Cible HTTP
GET
/publics/%2egit/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/publics/%2egit/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /publics/%2egit/config HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-0
dns-rebind
scanner-ua
Payload (extrait)
GET /publics/%2egit/config HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /publics/%2egit/config HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "dffdd03c5a3f6000d7374bbeda953224c20b9853",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.159657604417837,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "ea79c5ad3a40382512731889a924c34f7e7cba13",
"event_fingerprint": "1965946aa207b048ee960c7b663093d9d9259860",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "eb0951c9ad91a95e92aee2ff4ca611c2",
"path_pattern_hash": "c022a7a77ca5d3c8e53e008c45692091"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/publics\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/publics\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/publics\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/publics\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21f180b2e1e1d3242e618ff669907acaf0f82e10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/publics\/%2egit\/config",
"request_line": "GET \/publics\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/publics\/%2egit\/config",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/publics\/%2egit\/config",
"request_line": "GET \/publics\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/publics\/%2egit\/config",
"evidence_snippet": "GET \/publics\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_git_exposure",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /%2essh/public%2ecrt%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%2essh/public%2ecrt%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/%2essh/public%2ecrt%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/%2essh/public%2ecrt%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2essh/public%2ecrt%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /%2essh/public%2ecrt%2ebak HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /%2essh/public%2ecrt%2ebak HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "4161c777803c6e2a426033a05cdb91ccfb36ebb7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.17928709891908,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "82fbf6b5d30447cc9278aa8e18e94b9673a5715a",
"event_fingerprint": "7a693576b0f59b137aea4b65749e79463c23533c",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7f1552ebe06521b7d52d6a832be4f4d1",
"path_pattern_hash": "531a9de251d1f71df3608b911075179f"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/%2essh\/public%2ecrt%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1",
"request_sample": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/%2essh\/public%2ecrt%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1",
"request_sample": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8b610ae15993a65cb99576decdc38a2e114185a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2essh\/public%2ecrt%2ebak",
"request_line": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2essh\/public%2ecrt%2ebak",
"request_line": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak",
"evidence_snippet": "GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /server/laravel/docker-compose%2eglobal%2eyml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /server/laravel/docker-compose%2eglobal%2eyml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/server/laravel/docker-compose%2eglobal%2eyml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/server/laravel/docker-compose%2eglobal%2eyml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /server/laravel/docker-compose%2eglobal%2eyml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /server/laravel/docker-compose%2eglobal%2eyml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-E
Requête brute (extrait)
GET /server/laravel/docker-compose%2eglobal%2eyml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "7f07050fb319bb1f0c743200b0485d27a42e3cdd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 408,
"payload_entropy": 5.205006274270867,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "fa67d6359679a7a3158b9dec2316ac422c0f7711",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "bd4bbae72e8ec490f429ef48ea919003",
"path_pattern_hash": "d8daca7d08ee459742540f7e5191601e"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-E",
"method": "GET",
"path": "\/server\/laravel\/docker-compose%2eglobal%2eyml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1",
"request_sample": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX",
"payload_snippet": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-E",
"evidence": {
"method": "GET",
"path": "\/server\/laravel\/docker-compose%2eglobal%2eyml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1",
"request_sample": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX",
"payload_snippet": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-E",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4004c43e878c94392e024e5c17b6b2c2a4cf13a0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/laravel\/docker-compose%2eglobal%2eyml",
"request_line": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-E",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/laravel\/docker-compose%2eglobal%2eyml",
"request_line": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml",
"evidence_snippet": "GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-E",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /slack_api_key%2etxt
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /slack_api_key%2etxt UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/slack_api_key%2etxt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/slack_api_key%2etxt
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /slack_api_key%2etxt HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /slack_api_key%2etxt HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /slack_api_key%2etxt HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "4f67881f111a3db188813e19a5fedf72fc20a61a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.180978081989078,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "9acfba52ef92e10e53e65c6c741328af7d7834c0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "24152a350a5e4014546ff32e987e4e00",
"path_pattern_hash": "997b6c777514621d5fc0db4f7df9b95e"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/slack_api_key%2etxt",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/slack_api_key%2etxt HTTP\/1.1",
"request_sample": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/slack_api_key%2etxt",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/slack_api_key%2etxt HTTP\/1.1",
"request_sample": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0edeb8da1004e5a3a4d789da1b748e21ee63cbb8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/slack_api_key%2etxt",
"request_line": "GET \/slack_api_key%2etxt HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/slack_api_key%2etxt",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/slack_api_key%2etxt",
"request_line": "GET \/slack_api_key%2etxt HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/slack_api_key%2etxt",
"evidence_snippet": "GET \/slack_api_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /core/sql/settings%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /core/sql/settings%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/core/sql/settings%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/core/sql/settings%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/sql/settings%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /core/sql/settings%2ejson HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /core/sql/settings%2ejson HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "f713e687d10b1ef89cde41580dd4b64d36c1112d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.149820175225406,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "f97b65ab19fb62eb5403a9e6cc57bb6e9f2f247f",
"event_fingerprint": "0460d21580b2e64c72aa1874e156e79dbad07f44",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f45a15e07483ebe504d74f7a00f60941",
"path_pattern_hash": "f695599c426f3fa01dfc982b4508daaa"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/core\/sql\/settings%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/sql\/settings%2ejson HTTP\/1.1",
"request_sample": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/core\/sql\/settings%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/sql\/settings%2ejson HTTP\/1.1",
"request_sample": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b39720915047d80fa0279e6c75ae380596334a37",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/sql\/settings%2ejson",
"request_line": "GET \/core\/sql\/settings%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/sql\/settings%2ejson",
"request_line": "GET \/core\/sql\/settings%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson",
"evidence_snippet": "GET \/core\/sql\/settings%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /config/mailgun/sendgrid_api_key%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/mailgun/sendgrid_api_key%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/mailgun/sendgrid_api_key%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/config/mailgun/sendgrid_api_key%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/mailgun/sendgrid_api_key%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/mailgun/sendgrid_api_key%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding
Requête brute (extrait)
GET /config/mailgun/sendgrid_api_key%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "2be079332c04ba6dfd68b21873fe837316b2d866",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 401,
"payload_entropy": 5.2110770547298,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "256c105e86fafcbfd17cf96557cd44460b2864e0",
"event_fingerprint": "d1fd422c9d0644e47ba983164b13a088951aefaa",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "66fc83ef5003cc43baef66e9e0e9bfe7",
"path_pattern_hash": "d1f7a6c60f176de79efd6cf86e101bb6"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"method": "GET",
"path": "\/config\/mailgun\/sendgrid_api_key%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client",
"payload_snippet": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"evidence": {
"method": "GET",
"path": "\/config\/mailgun\/sendgrid_api_key%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client",
"payload_snippet": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4875e1cc8d1ead069485ba9be257279e93ba3cab",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/mailgun\/sendgrid_api_key%2eenv",
"request_line": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/mailgun\/sendgrid_api_key%2eenv",
"request_line": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv",
"evidence_snippet": "GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api/secrets/settings%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/secrets/settings%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/secrets/settings%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api/secrets/settings%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/secrets/settings%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/secrets/settings%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acc
Requête brute (extrait)
GET /api/secrets/settings%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "94a893c5793b7963caf14b2735bdb6517354bc00",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 390,
"payload_entropy": 5.137330833654709,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5c861b5f76d91eeded01051f17c524eb1c14fb78",
"event_fingerprint": "16ecf183b2bd1e75d802b09d68d37122d22a8c16",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e580d82db3a7c02b0420bae8f520bb95",
"path_pattern_hash": "7f8aef03e9383566f2641607540d417b"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"method": "GET",
"path": "\/api\/secrets\/settings%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/api\/secrets\/settings%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4c420ddb5b9bddc170054a9868c7afa1c4788d8e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/secrets\/settings%2eenv",
"request_line": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/secrets\/settings%2eenv",
"request_line": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv",
"evidence_snippet": "GET \/api\/secrets\/settings%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_k8s_probe",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /armnn/env%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /armnn/env%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/armnn/env%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/armnn/env%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /armnn/env%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /armnn/env%2eenv HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /armnn/env%2eenv HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "3018cb95243bc16776e28bb51ebdab0add14eda7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.141038641776303,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "b38450eed8a5f9f07fec4f80d678ff52250ae4fb",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "20f0435e0e2e0f78537b6d56ef51b53d",
"path_pattern_hash": "dd5aea81f1e2902d0553a9e84ef93dc3"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/armnn\/env%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/armnn\/env%2eenv HTTP\/1.1",
"request_sample": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/armnn\/env%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/armnn\/env%2eenv HTTP\/1.1",
"request_sample": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "065ff2f8e95b4a2d7bac336f9a894db35a4f27be",
"protocol_details": {
"http_method": "GET",
"http_path": "\/armnn\/env%2eenv",
"request_line": "GET \/armnn\/env%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/armnn\/env%2eenv",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/armnn\/env%2eenv",
"request_line": "GET \/armnn\/env%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/armnn\/env%2eenv",
"evidence_snippet": "GET \/armnn\/env%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /config/sample%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sample%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/sample%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/config/sample%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/sample%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/sample%2ebak HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /config/sample%2ebak HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "50aaaa9aa133d35fa3aa95c51c475620f1e9001c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.174540437769009,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "1c4b3fa62e104514d9494995da33f4427ab8cf7c",
"event_fingerprint": "b4f19743ce20feed08627bcff547a812d8bc2fd0",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "912fc30b214a79a58720b614f57634a4",
"path_pattern_hash": "8d06070e9c9922e376f5a87aad4d0fab"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/config\/sample%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/sample%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/config\/sample%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/sample%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b53c935c53312af7502e6050d1ffa57c8ef71ce0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sample%2ebak",
"request_line": "GET \/config\/sample%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sample%2ebak",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sample%2ebak",
"request_line": "GET \/config\/sample%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sample%2ebak",
"evidence_snippet": "GET \/config\/sample%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /%2ejenkins/hudson%2etasks%2eWebAssembly%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%2ejenkins/hudson%2etasks%2eWebAssembly%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/%2ejenkins/hudson%2etasks%2eWebAssembly%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/%2ejenkins/hudson%2etasks%2eWebAssembly%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2ejenkins/hudson%2etasks%2eWebAssembly%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /%2ejenkins/hudson%2etasks%2eWebAssembly%2exml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-
Requête brute (extrait)
GET /%2ejenkins/hudson%2etasks%2eWebAssembly%2exml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "f0d8eecf3e972fd0e3f7a8fce92e2d8d58bd987f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 409,
"payload_entropy": 5.25387155190407,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "18f01e1f677d271e073644384de0181c444fe2cc",
"event_fingerprint": "b646a129b82bf011a5085a1c9f057ecd08873f3c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a9760785a0e17f5067df5802105f13bb",
"path_pattern_hash": "570e00ca8fa297c6c2ecbda5b086280c"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-",
"method": "GET",
"path": "\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1",
"request_sample": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1",
"request_sample": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "444860a13afd89933ea18cc0273be53925f6991c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml",
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml",
"request_line": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml",
"evidence_snippet": "GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /settings%2epy%2eorig
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /settings%2epy%2eorig UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/settings%2epy%2eorig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/settings%2epy%2eorig
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /settings%2epy%2eorig HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /settings%2epy%2eorig HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /settings%2epy%2eorig HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "e8aa58d373021c43cb2633d417ebd462bc4d5a6d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.139897584087851,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "c3915116bf786343bec487d4ab82b98a810382c2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "eb0425008364ad1c203b3fac1524f8b8",
"path_pattern_hash": "11582cbdb6718d89141ec3d325abff39"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/settings%2epy%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/settings%2epy%2eorig HTTP\/1.1",
"request_sample": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/settings%2epy%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/settings%2epy%2eorig HTTP\/1.1",
"request_sample": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bbd6da303cd9221f1e63d3ae971037c317d11eb5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings%2epy%2eorig",
"request_line": "GET \/settings%2epy%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings%2epy%2eorig",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings%2epy%2eorig",
"request_line": "GET \/settings%2epy%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings%2epy%2eorig",
"evidence_snippet": "GET \/settings%2epy%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /db_backup%2eorig
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /db_backup%2eorig UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/db_backup%2eorig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/db_backup%2eorig
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /db_backup%2eorig HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /db_backup%2eorig HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /db_backup%2eorig HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "1a1df8569a055e01dff547d2c91d80018b3c63fd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.166094376683648,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "416d594f842614812f8cf438661e212edc3eeebb",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "647f2b8c485db5bddbde74dad290664b",
"path_pattern_hash": "26a995c3035b45deb7a329380dc9e8f2"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/db_backup%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/db_backup%2eorig HTTP\/1.1",
"request_sample": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/db_backup%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/db_backup%2eorig HTTP\/1.1",
"request_sample": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09a8ca586077cc027c6cffb6bbc3682b6010714c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/db_backup%2eorig",
"request_line": "GET \/db_backup%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db_backup%2eorig",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/db_backup%2eorig",
"request_line": "GET \/db_backup%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db_backup%2eorig",
"evidence_snippet": "GET \/db_backup%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /sendgrid_keys%2epy
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid_keys%2epy UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/sendgrid_keys%2epy
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/sendgrid_keys%2epy
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /sendgrid_keys%2epy HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /sendgrid_keys%2epy HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /sendgrid_keys%2epy HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "ad7c557a27f03efbb94ee075a06ecc82e512a9b0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.164869442189543,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "862c42437e74930e04591ff13c4c233471ac0fcb",
"event_fingerprint": "a38d2456ddbc54656130cbb209237815874c2a42",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a6cb4948ff006c1d3642ca284521eeba",
"path_pattern_hash": "32cf6532ea9dead35d7ba09b806b2a1f"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/sendgrid_keys%2epy",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sendgrid_keys%2epy HTTP\/1.1",
"request_sample": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/sendgrid_keys%2epy",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sendgrid_keys%2epy HTTP\/1.1",
"request_sample": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfacac2b5b8fd3165080c77e1e2958f2040f09b7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid_keys%2epy",
"request_line": "GET \/sendgrid_keys%2epy HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid_keys%2epy",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid_keys%2epy",
"request_line": "GET \/sendgrid_keys%2epy HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid_keys%2epy",
"evidence_snippet": "GET \/sendgrid_keys%2epy HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:7022 · (tentative d'exploit) · → /backend/phpinfo%2ephp
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/phpinfo%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950614:phpinfo
Cible HTTP
GET
/backend/phpinfo%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/backend/phpinfo%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backend/phpinfo%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
phpinfo
dns-rebind
scanner-ua
Payload (extrait)
GET /backend/phpinfo%2ephp HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /backend/phpinfo%2ephp HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "7a55745e8b12b180a3aacac8cac6645f60294342",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.180936133192691,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 81,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "a535d688a744f6e3888adac6dda5e4939a947a7d",
"event_fingerprint": "da9523cd78ce197fd1cacca4623ae75b6b9f8f26",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a6c3954d8e0d13b1dc89cd0bd5b4b1ad",
"path_pattern_hash": "58c4c498db915d13692a6e962f174c12"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/backend\/phpinfo%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950614:phpinfo",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"phpinfo",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/phpinfo%2ephp HTTP\/1.1",
"request_sample": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/backend\/phpinfo%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950614:phpinfo",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"phpinfo",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/phpinfo%2ephp HTTP\/1.1",
"request_sample": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bf41cb6f211a23ada4cfd979ffca325e884031e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/phpinfo%2ephp",
"request_line": "GET \/backend\/phpinfo%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/phpinfo%2ephp",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/phpinfo%2ephp",
"request_line": "GET \/backend\/phpinfo%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/phpinfo%2ephp",
"evidence_snippet": "GET \/backend\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950614:phpinfo",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /backup%2eyaml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /backup%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/backup%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/backup%2eyaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backup%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /backup%2eyaml HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /backup%2eyaml HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "ba4a41f51c1f3792ca8428cfb3c83cc2e8a2632f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.1688288848357535,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "91df34128376a4c1db38707f22ee8899eda17b22",
"event_fingerprint": "2b3cf4ddf3e483869aedae523aeb7760291b5276",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c03a4e30d0cda3eb427ed8e06b9703a3",
"path_pattern_hash": "a943e05b882b279cef2f6f021456e7cd"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/backup%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup%2eyaml HTTP\/1.1",
"request_sample": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/backup%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup%2eyaml HTTP\/1.1",
"request_sample": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e12f1d384dabbcce4e2afc2bc8d11d38f241e3f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup%2eyaml",
"request_line": "GET \/backup%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup%2eyaml",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup%2eyaml",
"request_line": "GET \/backup%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup%2eyaml",
"evidence_snippet": "GET \/backup%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
7022 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:7022 · (tentative d'exploit) · → /api/data/*
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/data/* UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/data/*
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7022
Chemin / cible
/api/data/*
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/data/* HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/data/* HTTP/1.1
Host: 62.3.50.33:7022
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
Requête brute (extrait)
GET /api/data/* HTTP/1.1 Host: 62.3.50.33:7022 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "4f712401f78fc064010a16683f21f84e7e961085",
"http_target_hash": "dea9678fd4238325011b7306db4cac9f89f581eb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 374,
"payload_entropy": 5.122973308878493,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 7022,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "3ea53a6f52f3d418bec2432daa9ec62bbf21177b",
"event_fingerprint": "5a95073c803d5f01849c687577281ac6338ecfac",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a3932b7452d904bb47b1e37902a46442",
"path_pattern_hash": "1dd281a6b15ed2db90e8c09fc51672e4"
},
"target_context": {
"dst_port": 7022,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en",
"method": "GET",
"path": "\/api\/data\/*",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/data\/* HTTP\/1.1",
"request_sample": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client",
"payload_snippet": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en",
"evidence": {
"method": "GET",
"path": "\/api\/data\/*",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/data\/* HTTP\/1.1",
"request_sample": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client",
"payload_snippet": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5864846a079278d52bc20bdc79aa38e3fb176801",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/data\/*",
"request_line": "GET \/api\/data\/* HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en",
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/data\/*",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7022,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/data\/*",
"request_line": "GET \/api\/data\/* HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 7022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:7022 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/data\/*",
"evidence_snippet": "GET \/api\/data\/* HTTP\/1.1\r\nHost: 62.3.50.33:7022\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en",
"target_port_label": "7022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|