|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /core/keys/wp-config%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /core/keys/wp-config%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/core/keys/wp-config%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/core/keys/wp-config%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/keys/wp-config%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /core/keys/wp-config%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /core/keys/wp-config%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "23883969568b0ad5c8f10ec2d5fa26029ee81317",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.189796878076882,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "9e38ef187d3b9328b16f804e43fea506b7a13e79",
"event_fingerprint": "16fb767286bb7a2d2c1d0c0e77d4669eec0d654d",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c0c2501bbdce8e07e8b669811d4fe094",
"path_pattern_hash": "9c8f7d403d5f9c8dde19ca20d20834c2"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/core\/keys\/wp-config%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/core\/keys\/wp-config%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec90eff55ae1cfb4e8523ddb90001089b7ffeeb4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/keys\/wp-config%2eenv",
"request_line": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/keys\/wp-config%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/keys\/wp-config%2eenv",
"request_line": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/keys\/wp-config%2eenv",
"evidence_snippet": "GET \/core\/keys\/wp-config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /aws_credentials%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /aws_credentials%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/aws_credentials%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/aws_credentials%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /aws_credentials%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /aws_credentials%2ejson HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /aws_credentials%2ejson HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b289ffac52c8480d1878f9bf1253b966cdf664a6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.178066925273414,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "2a3d5f9098719650dabcac860085406b1a75250a",
"event_fingerprint": "762adfcff44aab16ee15b787b454ccfe44b7cd33",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7999bbd385d5d6152e78e603f524b15f",
"path_pattern_hash": "1ae676afec95ccdc042531ac7aabf35b"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/aws_credentials%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/aws_credentials%2ejson HTTP\/1.1",
"request_sample": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/aws_credentials%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/aws_credentials%2ejson HTTP\/1.1",
"request_sample": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc3982acc932c7884032aa68fb4b07b40475db3a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/aws_credentials%2ejson",
"request_line": "GET \/aws_credentials%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/aws_credentials%2ejson",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/aws_credentials%2ejson",
"request_line": "GET \/aws_credentials%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/aws_credentials%2ejson",
"evidence_snippet": "GET \/aws_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /vendor/laravel/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /vendor/laravel/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/vendor/laravel/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/vendor/laravel/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /vendor/laravel/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /vendor/laravel/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /vendor/laravel/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "3b008469b8bf74c0bf01686e9203465969cea80f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.166322186001721,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "25f172d97a25a371e50219c37da9249b9bd2959d",
"event_fingerprint": "97819b7ddf56e211b64c0261b54cd574875472f1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "53da4e2c315dc56920a880e8dc0a3ef6",
"path_pattern_hash": "ccad569ddf449dff47aca788176e1f06"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/vendor\/laravel\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1",
"request_sample": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/vendor\/laravel\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1",
"request_sample": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5d0f58f3837c0d774b6517d25ca8382e6d18b956",
"protocol_details": {
"http_method": "GET",
"http_path": "\/vendor\/laravel\/%2eenv",
"request_line": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/vendor\/laravel\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/vendor\/laravel\/%2eenv",
"request_line": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/vendor\/laravel\/%2eenv",
"evidence_snippet": "GET \/vendor\/laravel\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_vendor",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /notification-service/%2eenv%2eproduction%2eloc…
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /notification-service/%2eenv%2eproduction%2elocal UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/notification-service/%2eenv%2eproduction%2elocal
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/notification-service/%2eenv%2eproduction%2elocal
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /notification-service/%2eenv%2eproduction%2elocal HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /notification-service/%2eenv%2eproduction%2elocal HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Acce
Requête brute (extrait)
GET /notification-service/%2eenv%2eproduction%2elocal HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "e91fd99d8fabffacbd5ed7d4023a4708bfc91d5d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 412,
"payload_entropy": 5.184220200197146,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "9b1cf9a351ec3a610c5bf1177ba7410b52548bc0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e4c7bceffd46de54af01d19ae60d2240",
"path_pattern_hash": "5204099df6deda59ca1a3da77436ae6b"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAcce",
"method": "GET",
"path": "\/notification-service\/%2eenv%2eproduction%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"request_sample": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.",
"payload_snippet": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/notification-service\/%2eenv%2eproduction%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"request_sample": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.",
"payload_snippet": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAcce",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d7e7f254e43523765f006bd35472a624b662e43",
"protocol_details": {
"http_method": "GET",
"http_path": "\/notification-service\/%2eenv%2eproduction%2elocal",
"request_line": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAcce",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/notification-service\/%2eenv%2eproduction%2eloc\u2026",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/notification-service\/%2eenv%2eproduction%2elocal",
"request_line": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/notification-service\/%2eenv%2eproduction%2eloc\u2026",
"evidence_snippet": "GET \/notification-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAcce",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /sendgrid/mailjet%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid/mailjet%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/sendgrid/mailjet%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/sendgrid/mailjet%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /sendgrid/mailjet%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /sendgrid/mailjet%2ejson HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /sendgrid/mailjet%2ejson HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "646a7f587df3e265b8e54b96afb42273e3ac4eb9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.183245734950055,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "546a74bba04d0514c754dc0707b50ffb6c2dd27b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "81bd469958f4d8504c2469be6c60baf7",
"path_pattern_hash": "b4bbf87f82c0ec37be28c94707885e9a"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/sendgrid\/mailjet%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1",
"request_sample": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/mailjet%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1",
"request_sample": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e2b3eef231e5cff37061039d69cdcca0b29bf673",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/mailjet%2ejson",
"request_line": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/mailjet%2ejson",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/mailjet%2ejson",
"request_line": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/mailjet%2ejson",
"evidence_snippet": "GET \/sendgrid\/mailjet%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /config/smtp%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/smtp%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/smtp%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/config/smtp%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/smtp%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/smtp%2ejson HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /config/smtp%2ejson HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "92dbe11f971ba30e3567985f715af72c7712b302",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.1876308244264075,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "34e3ca1be78681610635664544878ce1c7a49ad6",
"event_fingerprint": "2285cd19a3396f3bdb30af830395f6fc0e510ec1",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "655e91fd1f253a9e0cce802ee25022fd",
"path_pattern_hash": "7a96e5d216ea4e8492843a398ce4c39e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/config\/smtp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/smtp%2ejson HTTP\/1.1",
"request_sample": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/config\/smtp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/smtp%2ejson HTTP\/1.1",
"request_sample": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c28d66b34b0dc37ee5ebd8088015410e584a1a66",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/smtp%2ejson",
"request_line": "GET \/config\/smtp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/smtp%2ejson",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/smtp%2ejson",
"request_line": "GET \/config\/smtp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/smtp%2ejson",
"evidence_snippet": "GET \/config\/smtp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /unit/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /unit/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/unit/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/unit/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /unit/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /unit/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /unit/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "ebe76c3931e8c8b5fcf871e7e0c16ace3f003dbd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.147679570545374,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "8326961692413bc954c0ebdf5b3bd688e25bf2b1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "2a952bb7b1917302308efa7d7b03eace",
"path_pattern_hash": "4dda78edad25dc73c774b0e20b1832f9"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/unit\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/unit\/%2eenv HTTP\/1.1",
"request_sample": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/unit\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/unit\/%2eenv HTTP\/1.1",
"request_sample": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31e8c67c461964a5df378b695da7bbd04de3f4ad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/unit\/%2eenv",
"request_line": "GET \/unit\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/unit\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/unit\/%2eenv",
"request_line": "GET \/unit\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/unit\/%2eenv",
"evidence_snippet": "GET \/unit\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /%2eaws/wp-config%2ebak%2eorig
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eaws/wp-config%2ebak%2eorig UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/%2eaws/wp-config%2ebak%2eorig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/%2eaws/wp-config%2ebak%2eorig
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
SIGMA-web-config-leak
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eaws/wp-config%2ebak%2eorig HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eaws/wp-config%2ebak%2eorig HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /%2eaws/wp-config%2ebak%2eorig HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "ade103523f8e0698c3f37138006e1551c468fc69",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 393,
"payload_entropy": 5.197818097608363,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "0225872f26bed437ad68b07948aea172017d73fd",
"event_fingerprint": "acfcb62033cabf6a95d2baa26a1df1ad34a8d287",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 143,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "526a12909802fa2b2bb96cf65d8573b0",
"path_pattern_hash": "9a359cba7d0e6800a7418fd5223a8f13"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n",
"method": "GET",
"path": "\/%2eaws\/wp-config%2ebak%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1",
"request_sample": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/%2eaws\/wp-config%2ebak%2eorig",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1",
"request_sample": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87025dbe45ae32c629ed78201e8d8dc1f7f71160",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eaws\/wp-config%2ebak%2eorig",
"request_line": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eaws\/wp-config%2ebak%2eorig",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eaws\/wp-config%2ebak%2eorig",
"request_line": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eaws\/wp-config%2ebak%2eorig",
"evidence_snippet": "GET \/%2eaws\/wp-config%2ebak%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /mail/postmark_key%2etxt
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /mail/postmark_key%2etxt UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/mail/postmark_key%2etxt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/mail/postmark_key%2etxt
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /mail/postmark_key%2etxt HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /mail/postmark_key%2etxt HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /mail/postmark_key%2etxt HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "84533df2c2aad588bb634f61fe46456888e1baf4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.216872342312677,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "776306b0167bde56a3428ce894de0341fb726ef1",
"event_fingerprint": "67a8f3ec33658310505043221477df9dd2b2adce",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f8247a827cb5ca60b1395f7a1a1f22a5",
"path_pattern_hash": "01d09ce834290b59557073400be168bf"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/mail\/postmark_key%2etxt",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mail\/postmark_key%2etxt HTTP\/1.1",
"request_sample": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/mail\/postmark_key%2etxt",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mail\/postmark_key%2etxt HTTP\/1.1",
"request_sample": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ed1f68705a7fa602297cc4b4bb45ee38c8f5a1c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/postmark_key%2etxt",
"request_line": "GET \/mail\/postmark_key%2etxt HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/postmark_key%2etxt",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/postmark_key%2etxt",
"request_line": "GET \/mail\/postmark_key%2etxt HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/postmark_key%2etxt",
"evidence_snippet": "GET \/mail\/postmark_key%2etxt HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_mail",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /db%2ecfg
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /db%2ecfg UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/db%2ecfg
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/db%2ecfg
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /db%2ecfg HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /db%2ecfg HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-U
Requête brute (extrait)
GET /db%2ecfg HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-I
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "92195c80bf11b3fb198ba40af08373458a8e86eb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 372,
"payload_entropy": 5.162778414263857,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "2a3d5f9098719650dabcac860085406b1a75250a",
"event_fingerprint": "362010a4b3ff76a21ca7611843465c8b0a407d36",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "32ec1aa3d96157bdca15b9e091d930bf",
"path_pattern_hash": "28e95496a90bb4ef442100fd13386bc7"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"method": "GET",
"path": "\/db%2ecfg",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/db%2ecfg HTTP\/1.1",
"request_sample": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"evidence": {
"method": "GET",
"path": "\/db%2ecfg",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/db%2ecfg HTTP\/1.1",
"request_sample": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8de9be21a11125b197a7bee96bef27df22851e21",
"protocol_details": {
"http_method": "GET",
"http_path": "\/db%2ecfg",
"request_line": "GET \/db%2ecfg HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db%2ecfg",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/db%2ecfg",
"request_line": "GET \/db%2ecfg HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db%2ecfg",
"evidence_snippet": "GET \/db%2ecfg HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /vendor/%2eenv%2esave
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /vendor/%2eenv%2esave UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/vendor/%2eenv%2esave
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/vendor/%2eenv%2esave
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /vendor/%2eenv%2esave HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /vendor/%2eenv%2esave HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /vendor/%2eenv%2esave HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "c29cf7408f6d2c2d9d26c7e33557ea7808bb8252",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.16696734210089,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "25f172d97a25a371e50219c37da9249b9bd2959d",
"event_fingerprint": "73d9321498e52ed6c75d0c325c04926738c9f548",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "daea9e85ebf58fb3c5140f99832e0c28",
"path_pattern_hash": "553deb9273b5756ac1ee2589ed5a204e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/vendor\/%2eenv%2esave",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/vendor\/%2eenv%2esave HTTP\/1.1",
"request_sample": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/vendor\/%2eenv%2esave",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/vendor\/%2eenv%2esave HTTP\/1.1",
"request_sample": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b25ccd4b89634cae34a2fa7d8e7fa01364cee820",
"protocol_details": {
"http_method": "GET",
"http_path": "\/vendor\/%2eenv%2esave",
"request_line": "GET \/vendor\/%2eenv%2esave HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/vendor\/%2eenv%2esave",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/vendor\/%2eenv%2esave",
"request_line": "GET \/vendor\/%2eenv%2esave HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/vendor\/%2eenv%2esave",
"evidence_snippet": "GET \/vendor\/%2eenv%2esave HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_vendor",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /azure-credentials_eks
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /azure-credentials_eks UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/azure-credentials_eks
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/azure-credentials_eks
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /azure-credentials_eks HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /azure-credentials_eks HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /azure-credentials_eks HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "ee0e94f6be9f0141ac824bda029c30f795b1f70f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.152871975352015,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "2a3d5f9098719650dabcac860085406b1a75250a",
"event_fingerprint": "e000e28c19e2c4557702b0b743e2c0b510274db1",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ad0aa22c150d64920d59058e0c6887ea",
"path_pattern_hash": "577ade900d10ef8355454ce28047c5c6"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/azure-credentials_eks",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/azure-credentials_eks HTTP\/1.1",
"request_sample": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/azure-credentials_eks",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/azure-credentials_eks HTTP\/1.1",
"request_sample": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34766d6318af6022decf6899395ddcb0a3608740",
"protocol_details": {
"http_method": "GET",
"http_path": "\/azure-credentials_eks",
"request_line": "GET \/azure-credentials_eks HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/azure-credentials_eks",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/azure-credentials_eks",
"request_line": "GET \/azure-credentials_eks HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/azure-credentials_eks",
"evidence_snippet": "GET \/azure-credentials_eks HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:8042 · (tentative d'exploit) · → /var/www/%2essh/id_ecdsa
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /var/www/%2essh/id_ecdsa UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950312:lfi-13
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/var/www/%2essh/id_ecdsa
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/var/www/%2essh/id_ecdsa
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « lfi-13 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
pat-0494
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred SSH private key id_ecdsa
SSRF Localhost SSRF
Ligne de requête
GET /var/www/%2essh/id_ecdsa HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-13
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /var/www/%2essh/id_ecdsa HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /var/www/%2essh/id_ecdsa HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "abbe226f672da7be04b499d5e92a4e28f824066a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.207832054862893,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "dec3aed206446f24525e9df6fbf3e99c5c675c6a",
"event_fingerprint": "6da90f750b6396cf0bd5e1b1add3b1441fe20550",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0494",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0494",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0494",
"pat-0340"
],
"matched_pattern_names": [
"Cred SSH private key id_ecdsa",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0494",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0f39a6422cc7c25eb1400e6db0d7d6c9",
"path_pattern_hash": "c011102b9c76d0b12c7e455b35ea698b"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/var\/www\/%2essh\/id_ecdsa",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950312:lfi-13",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-13",
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1",
"request_sample": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/var\/www\/%2essh\/id_ecdsa",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950312:lfi-13",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-13",
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1",
"request_sample": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e7311358e0580c63f1a08273b11d72c8c56dd31",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/%2essh\/id_ecdsa",
"request_line": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "credential file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/%2essh\/id_ecdsa",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"pat-0494",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0494",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/%2essh\/id_ecdsa",
"request_line": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/%2essh\/id_ecdsa",
"evidence_snippet": "GET \/var\/www\/%2essh\/id_ecdsa HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950312:lfi-13",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /backup%2ecsv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /backup%2ecsv UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/backup%2ecsv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/backup%2ecsv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backup%2ecsv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /backup%2ecsv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /backup%2ecsv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clie
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "6db0e1a1f1a5f8c880eda49ea09ff3bd0a7ad6c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 376,
"payload_entropy": 5.177497321320253,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "5ea5c93a04f96b0a42c0eaad2446e4d18b6efba3",
"event_fingerprint": "5c7043a0a9c1e7bea0d53bbb7c714ada66c05645",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5b733de712d42428ad0d9da35dfaaaca",
"path_pattern_hash": "f7766c98d4cee8e2e689e193c0657d4f"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: ",
"method": "GET",
"path": "\/backup%2ecsv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup%2ecsv HTTP\/1.1",
"request_sample": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/backup%2ecsv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup%2ecsv HTTP\/1.1",
"request_sample": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fab7c885ba50ffc9e2555b8a6b6679457bb7992c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup%2ecsv",
"request_line": "GET \/backup%2ecsv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup%2ecsv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup%2ecsv",
"request_line": "GET \/backup%2ecsv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup%2ecsv",
"evidence_snippet": "GET \/backup%2ecsv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /app/frontend/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/frontend/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/app/frontend/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/app/frontend/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /app/frontend/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /app/frontend/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /app/frontend/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "a23c5481ca58fde893c71cd73d45f6e8ba80df5d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.168162253510123,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "6d5f0f775eaa116af49e90292bb12846fdacd770",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "50f24b233b2bbd8b509deb8b2b40b76e",
"path_pattern_hash": "3d520723118d72fb67e47aab1d263b93"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/app\/frontend\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/frontend\/%2eenv HTTP\/1.1",
"request_sample": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/app\/frontend\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/frontend\/%2eenv HTTP\/1.1",
"request_sample": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2a0c5f65573644ea034a571d4c9847c8aa2a2c1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/frontend\/%2eenv",
"request_line": "GET \/app\/frontend\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/frontend\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/frontend\/%2eenv",
"request_line": "GET \/app\/frontend\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/frontend\/%2eenv",
"evidence_snippet": "GET \/app\/frontend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /src/main/resources/drone%2eproperties
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/main/resources/drone%2eproperties UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/src/main/resources/drone%2eproperties
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/src/main/resources/drone%2eproperties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941150
SSRF Localhost SSRF
Ligne de requête
GET /src/main/resources/drone%2eproperties HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /src/main/resources/drone%2eproperties HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding
Requête brute (extrait)
GET /src/main/resources/drone%2eproperties HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "2e7cc921ee2b6c3649dbd6f8bac8c5b59b836eec",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 401,
"payload_entropy": 5.163254922057293,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "76912989a26c275ff0d1685031f8c3623f937296",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0286",
"pat-0340"
],
"matched_pattern_names": [
"CRS 941150",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0286",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7bd857f9d4fd76f4d4f5467bd06f53fb",
"path_pattern_hash": "6b5654a2b0f7f3443ed50bc48095d86c"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"method": "GET",
"path": "\/src\/main\/resources\/drone%2eproperties",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1",
"request_sample": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client",
"payload_snippet": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"evidence": {
"method": "GET",
"path": "\/src\/main\/resources\/drone%2eproperties",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1",
"request_sample": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client",
"payload_snippet": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "410ecc494480974b56e3a7078e1f000ad05ec690",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/main\/resources\/drone%2eproperties",
"request_line": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/main\/resources\/drone%2eproperties",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/main\/resources\/drone%2eproperties",
"request_line": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/main\/resources\/drone%2eproperties",
"evidence_snippet": "GET \/src\/main\/resources\/drone%2eproperties HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /resources/docker/mysql/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /resources/docker/mysql/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/resources/docker/mysql/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/resources/docker/mysql/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /resources/docker/mysql/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /resources/docker/mysql/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /resources/docker/mysql/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "c97067a3d42d2446293767ccec6cd885fe14d5d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 393,
"payload_entropy": 5.200751237493164,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "89cd1fe83ebe53e13718e421d6d298c03f32133b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "30168ff99eb43fc84681eec2ca2edc54",
"path_pattern_hash": "328bd2db52d2213be3377a10584bce2c"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n",
"method": "GET",
"path": "\/resources\/docker\/mysql\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1",
"request_sample": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/resources\/docker\/mysql\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1",
"request_sample": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39345b98acc1f171939566bb0cecf910cb6bc270",
"protocol_details": {
"http_method": "GET",
"http_path": "\/resources\/docker\/mysql\/%2eenv",
"request_line": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/resources\/docker\/mysql\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/resources\/docker\/mysql\/%2eenv",
"request_line": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/resources\/docker\/mysql\/%2eenv",
"evidence_snippet": "GET \/resources\/docker\/mysql\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /proc/index%2ecgi
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /proc/index%2ecgi UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/proc/index%2ecgi
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/proc/index%2ecgi
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /proc/index%2ecgi HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /proc/index%2ecgi HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /proc/index%2ecgi HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "071b6b7e59b9221486cf638e5d89cdaff669e9c4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.155922462343792,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "ddccb2c227a0ef10a60ef4c5c1eccad6d8806bbb",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "fa27c382ffefac747443088d4cf0f171",
"path_pattern_hash": "380bbcd75b900b1cc1cd543163b2f732"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/proc\/index%2ecgi",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/proc\/index%2ecgi HTTP\/1.1",
"request_sample": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/proc\/index%2ecgi",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/proc\/index%2ecgi HTTP\/1.1",
"request_sample": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9041637c949b49dabe5a15671449b4fc13f5e2db",
"protocol_details": {
"http_method": "GET",
"http_path": "\/proc\/index%2ecgi",
"request_line": "GET \/proc\/index%2ecgi HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/proc\/index%2ecgi",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/proc\/index%2ecgi",
"request_line": "GET \/proc\/index%2ecgi HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/proc\/index%2ecgi",
"evidence_snippet": "GET \/proc\/index%2ecgi HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /actuator/retryevents
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /actuator/retryevents UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/actuator/retryevents
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/actuator/retryevents
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Probe /actuator
Ligne de requête
GET /actuator/retryevents HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /actuator/retryevents HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /actuator/retryevents HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b2441fb85ef6a0f8a37776ab4619304f2f3472db",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.150129544978266,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "adcdaec94891ad3b8333adc3eabc35d7e0c40792",
"event_fingerprint": "cd6c18c5db2c3fecfdedc1b11e6e8b2370f6013c",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0232"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"Probe \/actuator"
],
"pattern_ids": [
"pat-0340",
"pat-0232"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e685ec38f71edccfcdc62dbcc60d9c36",
"path_pattern_hash": "160aba6925675cc376b0540c58829e0f"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/actuator\/retryevents",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/actuator\/retryevents HTTP\/1.1",
"request_sample": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/actuator\/retryevents",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/actuator\/retryevents HTTP\/1.1",
"request_sample": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2fdf4ee63006f31fd5339c035d84ca60151ba500",
"protocol_details": {
"http_method": "GET",
"http_path": "\/actuator\/retryevents",
"request_line": "GET \/actuator\/retryevents HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/actuator\/retryevents",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/actuator\/retryevents",
"request_line": "GET \/actuator\/retryevents HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/actuator\/retryevents",
"evidence_snippet": "GET \/actuator\/retryevents HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_actuator",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /config/sql/login%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sql/login%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/sql/login%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/config/sql/login%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/sql/login%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/sql/login%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /config/sql/login%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "d73da79e3978e23c84362ba2ec5b1973a470f535",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.181047178718148,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "34e3ca1be78681610635664544878ce1c7a49ad6",
"event_fingerprint": "206dc341df3eaa50c2b265de4602ed9c11d1f524",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d11db0d7c0214e5a98d0d921df8c6542",
"path_pattern_hash": "3833169f9314cdad169246763048fce0"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/config\/sql\/login%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/sql\/login%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/config\/sql\/login%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/sql\/login%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62024168d1bc01e5fc22eaed4751e94125102f99",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sql\/login%2eenv",
"request_line": "GET \/config\/sql\/login%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sql\/login%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sql\/login%2eenv",
"request_line": "GET \/config\/sql\/login%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sql\/login%2eenv",
"evidence_snippet": "GET \/config\/sql\/login%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /website/%2eenv%2edev
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /website/%2eenv%2edev UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/website/%2eenv%2edev
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/website/%2eenv%2edev
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /website/%2eenv%2edev HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /website/%2eenv%2edev HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /website/%2eenv%2edev HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b39406c98c289d54e66af97c79ee4dcc6619f3e2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.174909767314109,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "5ce30d810b4aed8e104090eab83a0e26ddc25c7e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0e3403ca52989d9d00318fd50cf4d083",
"path_pattern_hash": "2a2c1a6d22654f9caf86e5ba1eab6810"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/website\/%2eenv%2edev",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/website\/%2eenv%2edev HTTP\/1.1",
"request_sample": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/website\/%2eenv%2edev",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/website\/%2eenv%2edev HTTP\/1.1",
"request_sample": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff040437d1c269adaf76687c18ffcdd0060b42b7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/website\/%2eenv%2edev",
"request_line": "GET \/website\/%2eenv%2edev HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/website\/%2eenv%2edev",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/website\/%2eenv%2edev",
"request_line": "GET \/website\/%2eenv%2edev HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/website\/%2eenv%2edev",
"evidence_snippet": "GET \/website\/%2eenv%2edev HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /k8s/clusterrolebinding%2eyaml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /k8s/clusterrolebinding%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/k8s/clusterrolebinding%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/k8s/clusterrolebinding%2eyaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /k8s/clusterrolebinding%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /k8s/clusterrolebinding%2eyaml HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /k8s/clusterrolebinding%2eyaml HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "61c0c79dc222885ba74028246d85c90437f2b51c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 393,
"payload_entropy": 5.204058349680688,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "9bda89c41af0e86c9563032258f77741e02bff50",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "cb54df321138f6eb515dc4a0c61a98b0",
"path_pattern_hash": "2667c290b49550ab8b69e0b5786ece59"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n",
"method": "GET",
"path": "\/k8s\/clusterrolebinding%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1",
"request_sample": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/k8s\/clusterrolebinding%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1",
"request_sample": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98b3d1da6728e99bd7fddf2f7a39671829abfbff",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/clusterrolebinding%2eyaml",
"request_line": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/k8s\/clusterrolebinding%2eyaml",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/clusterrolebinding%2eyaml",
"request_line": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/k8s\/clusterrolebinding%2eyaml",
"evidence_snippet": "GET \/k8s\/clusterrolebinding%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /wp-admin/network%2ephp
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-admin/network%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
32
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950503:cms-1
Cible HTTP
GET
/wp-admin/network%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/wp-admin/network%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-admin/network%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
cms-1
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-admin/network%2ephp HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /wp-admin/network%2ephp HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "fc658a64f849a4f2b36f407083164751629cc90b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.186324065394831,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "7f4305a60352105dacc176c885caa46cb0ade275",
"event_fingerprint": "a969467d62f0c6e947f185c1cc471489720f8154",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "340675390d3f48fb0717c84eacb66b7a",
"path_pattern_hash": "bb48640907e809cb00fbec73b86e3256"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/wp-admin\/network%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950503:cms-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-admin\/network%2ephp HTTP\/1.1",
"request_sample": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/wp-admin\/network%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950503:cms-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-admin\/network%2ephp HTTP\/1.1",
"request_sample": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7bf7c736173f385bd64de6909f64c51f6839fc8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-admin\/network%2ephp",
"request_line": "GET \/wp-admin\/network%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-admin\/network%2ephp",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-admin\/network%2ephp",
"request_line": "GET \/wp-admin\/network%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-admin\/network%2ephp",
"evidence_snippet": "GET \/wp-admin\/network%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950503:cms-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /api/config/login%2esql
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/config/login%2esql UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/config/login%2esql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/api/config/login%2esql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/config/login%2esql HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/config/login%2esql HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /api/config/login%2esql HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "d34f881e5e59d9e8ea053d79267c94f8fcd90e5b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.176745041243126,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "cc0d5b106f77e43c061063c699111b1932c0e91e",
"event_fingerprint": "17df46d601489021a983df81d3d0f20f529d632f",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "216735c8fa054022929d9f11baa41718",
"path_pattern_hash": "f4bec7729653d6fb22e6d87fd1afda51"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/api\/config\/login%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/config\/login%2esql HTTP\/1.1",
"request_sample": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/api\/config\/login%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/config\/login%2esql HTTP\/1.1",
"request_sample": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81362f685d0e3e0ea0e9c1e8e1788ece1b6a9fa5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config\/login%2esql",
"request_line": "GET \/api\/config\/login%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config\/login%2esql",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config\/login%2esql",
"request_line": "GET \/api\/config\/login%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config\/login%2esql",
"evidence_snippet": "GET \/api\/config\/login%2esql HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /config/test/users%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/test/users%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/test/users%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/config/test/users%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/test/users%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/test/users%2ebak HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /config/test/users%2ebak HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "77866a8d6468e978d669af99a32bff69b90822a4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.182495104315809,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "bada45506d52494335defb7c1bc0b351cd007482",
"event_fingerprint": "d774bfbbe68e4026ef44724eff6e5da484cdb933",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "daefc6828559364e2f3ab14e4406dfc2",
"path_pattern_hash": "9b1aedf9bb0af8f891ce4209d84801dc"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/config\/test\/users%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/test\/users%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/config\/test\/users%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/test\/users%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48417c0836622c549540d06b27ddd3cbe50204c9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/test\/users%2ebak",
"request_line": "GET \/config\/test\/users%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/test\/users%2ebak",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/test\/users%2ebak",
"request_line": "GET \/config\/test\/users%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/test\/users%2ebak",
"evidence_snippet": "GET \/config\/test\/users%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /media/%2evscode/sftp%2ejson
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /media/%2evscode/sftp%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/media/%2evscode/sftp%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/media/%2evscode/sftp%2ejson
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /media/%2evscode/sftp%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /media/%2evscode/sftp%2ejson HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Ac
Requête brute (extrait)
GET /media/%2evscode/sftp%2ejson HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "0c4fca5528dc2d107eb41987e5cbd648c9b6878a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 391,
"payload_entropy": 5.211017257148922,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "ae03f9db9bad74a9482f73ce782c5bb9af0f00a9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "2c8d29a116cd50d3514b3f0e759250c3",
"path_pattern_hash": "35a89c0d36e575fae32391d7daaf8861"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"method": "GET",
"path": "\/media\/%2evscode\/sftp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1",
"request_sample": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"evidence": {
"method": "GET",
"path": "\/media\/%2evscode\/sftp%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1",
"request_sample": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a1997203d6a86b33dafc45f8df29188190da560",
"protocol_details": {
"http_method": "GET",
"http_path": "\/media\/%2evscode\/sftp%2ejson",
"request_line": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/media\/%2evscode\/sftp%2ejson",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/media\/%2evscode\/sftp%2ejson",
"request_line": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/media\/%2evscode\/sftp%2ejson",
"evidence_snippet": "GET \/media\/%2evscode\/sftp%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /srv/%2essh/cert%2epem
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /srv/%2essh/cert%2epem UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/srv/%2essh/cert%2epem
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/srv/%2essh/cert%2epem
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /srv/%2essh/cert%2epem HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /srv/%2essh/cert%2epem HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /srv/%2essh/cert%2epem HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "db4e0cfb531a4d719a9093915dbb5e0dc9a5aed2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.187596545963651,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "106cc3cc880ca14f8226c3c766f378fc4aa4f593",
"event_fingerprint": "578f3f51f78b38db2123a07d5b9c7c41c16d5f1a",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "fe9d4dadb71dda6d48ecaf5447c80671",
"path_pattern_hash": "e85c163b3f5342b4c2961fec0ff3aff3"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/srv\/%2essh\/cert%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1",
"request_sample": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/srv\/%2essh\/cert%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1",
"request_sample": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e94620c0577aba6b89bef637af75ed72770fb518",
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/%2essh\/cert%2epem",
"request_line": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/%2essh\/cert%2epem",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/%2essh\/cert%2epem",
"request_line": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/%2essh\/cert%2epem",
"evidence_snippet": "GET \/srv\/%2essh\/cert%2epem HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /team/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /team/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/team/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/team/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /team/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /team/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /team/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b8d640bd17e6b926ba4984c1d1f4f1f7f2af8cc7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.157209737050357,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "db2b6bdc09a56d618e57fb9130ba62fa10c26e16",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a37c19c7c8d1fc4dfd8a80094cdd7c60",
"path_pattern_hash": "79617413ebdd51f03111b3dc0066e53c"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/team\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/team\/%2eenv HTTP\/1.1",
"request_sample": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/team\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/team\/%2eenv HTTP\/1.1",
"request_sample": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "099ff02e72f2cef4b7740617f73706d8d8e826ab",
"protocol_details": {
"http_method": "GET",
"http_path": "\/team\/%2eenv",
"request_line": "GET \/team\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/team\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/team\/%2eenv",
"request_line": "GET \/team\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/team\/%2eenv",
"evidence_snippet": "GET \/team\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /config/%2eenv%2estaging
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /config/%2eenv%2estaging UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/config/%2eenv%2estaging
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/config/%2eenv%2estaging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/%2eenv%2estaging HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /config/%2eenv%2estaging HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept
Requête brute (extrait)
GET /config/%2eenv%2estaging HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "6023c630ddb3f76e6e538994b8bf1a465214bebc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 387,
"payload_entropy": 5.172374149491085,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "fe8043b0c147566727156e335a70b372a040d5bd",
"event_fingerprint": "c5ec1ca7110c50c9a6e81790c9ef64caa0a79d5e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "141426104e94f7ef4d8aa64387dc866b",
"path_pattern_hash": "e8eadb779f9cef06a78aa9423e87a4fa"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"method": "GET",
"path": "\/config\/%2eenv%2estaging",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/%2eenv%2estaging HTTP\/1.1",
"request_sample": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/config\/%2eenv%2estaging",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/%2eenv%2estaging HTTP\/1.1",
"request_sample": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1",
"payload_snippet": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86e66a93f396441cb153a197b302c62b471d4eeb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/%2eenv%2estaging",
"request_line": "GET \/config\/%2eenv%2estaging HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/%2eenv%2estaging",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/%2eenv%2estaging",
"request_line": "GET \/config\/%2eenv%2estaging HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/%2eenv%2estaging",
"evidence_snippet": "GET \/config\/%2eenv%2estaging HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /srv/aws_credentials%2eenv
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /srv/aws_credentials%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/srv/aws_credentials%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/srv/aws_credentials%2eenv
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /srv/aws_credentials%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /srv/aws_credentials%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /srv/aws_credentials%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "988920a73a5efafa433396c866dc672f7f2b27d6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.1841643804164566,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "60fcbf83a8bc621792965d8369573e2e062c8387",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "09c1c64b6d55f51d7dc0a376cb255e72",
"path_pattern_hash": "c1d750dc98ae76521f8932885fd006ae"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/srv\/aws_credentials%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1",
"request_sample": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/srv\/aws_credentials%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1",
"request_sample": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbac8658d8d9816db5da028902bbc230bf66aff6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/aws_credentials%2eenv",
"request_line": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/aws_credentials%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/aws_credentials%2eenv",
"request_line": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/aws_credentials%2eenv",
"evidence_snippet": "GET \/srv\/aws_credentials%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /var/log/
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /var/log/ UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/var/log/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/var/log/
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /var/log/ HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /var/log/ HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-U
Requête brute (extrait)
GET /var/log/ HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-I
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "17bafac3d010c4f55734633ed252bd39143d09d4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 372,
"payload_entropy": 5.146787647086185,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "a7443cbd7f3bd445dead6c3fb944d03aa61ddc95",
"event_fingerprint": "f2c8dae7489815a6512881c407f1fb48ec25336f",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "acaf384359839c9a272e1a1b62adeb3d",
"path_pattern_hash": "7da17b0db8d66ab2e10fdbe982c44f6e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"method": "GET",
"path": "\/var\/log\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/var\/log\/ HTTP\/1.1",
"request_sample": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"evidence": {
"method": "GET",
"path": "\/var\/log\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/var\/log\/ HTTP\/1.1",
"request_sample": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5e8c49521bc444bf1e6d486c331139c55e58a27",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/log\/",
"request_line": "GET \/var\/log\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/log\/",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/log\/",
"request_line": "GET \/var\/log\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/log\/",
"evidence_snippet": "GET \/var\/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /core/config/log%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /core/config/log%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/core/config/log%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/core/config/log%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/config/log%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /core/config/log%2ebak HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /core/config/log%2ebak HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "70557c8b22a84e9593cf38b2f391a5effe4b759b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.178127770485996,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "04f136cdbb6e515609a2bbf4ddcbd02cebb244b5",
"event_fingerprint": "a11e278d82a763158f20941483e1bd3920023724",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "10c58f120f2b80e81e7268feed2c6097",
"path_pattern_hash": "9d2cf8a83d4d6d4a7a16d7f963eb7a5e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/core\/config\/log%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/config\/log%2ebak HTTP\/1.1",
"request_sample": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/core\/config\/log%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/config\/log%2ebak HTTP\/1.1",
"request_sample": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55c73c24663ba452416f1ac3c7031004f2d9d8c7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/config\/log%2ebak",
"request_line": "GET \/core\/config\/log%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/config\/log%2ebak",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/config\/log%2ebak",
"request_line": "GET \/core\/config\/log%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/config\/log%2ebak",
"evidence_snippet": "GET \/core\/config\/log%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /admin/postmark%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/postmark%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/postmark%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/admin/postmark%2eenv
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/postmark%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/postmark%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /admin/postmark%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "3f9568f0a7d68cab3aa3583426061ed4abd482ec",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.18777758607029,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "27d30f8e8622f30238f9f733bce7c3908b246d39",
"event_fingerprint": "bce9c146961c5f0f36cf75bdb6d6406537c7833b",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "33b37df308f08ce5a1dd6d4de90c1fd5",
"path_pattern_hash": "6944166ba5b3cac95525fb5c788f4271"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/admin\/postmark%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/postmark%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/admin\/postmark%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/postmark%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "790730143bb68e445b42fd99cf4ab3e61564a0d3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/postmark%2eenv",
"request_line": "GET \/admin\/postmark%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/postmark%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/postmark%2eenv",
"request_line": "GET \/admin\/postmark%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/postmark%2eenv",
"evidence_snippet": "GET \/admin\/postmark%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /v3/%2egit/config
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /v3/%2egit/config UA curl/8.7.1
Émulateur
HTTP
WAF
45
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/v3/%2egit/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/v3/%2egit/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /v3/%2egit/config HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
leak-0
dns-rebind
scanner-ua
Payload (extrait)
GET /v3/%2egit/config HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /v3/%2egit/config HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "7b6c7f0834a17dc18d6ed4a9b7c33c3dce648819",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.171993817361217,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "dd3bc2e636dc5c7db76e6c6932e0d2bf0613c1fb",
"event_fingerprint": "6438345b3fcb1df7f28581f07c8022934ffca72d",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3fa93dca440243326c91bd384cad8abb",
"path_pattern_hash": "b0c5045aa4175e52f47c48c433bd227e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/v3\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/v3\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/v3\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/v3\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2341ad8220b2304470618212cc83e5f37dd451f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/v3\/%2egit\/config",
"request_line": "GET \/v3\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/%2egit\/config",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/v3\/%2egit\/config",
"request_line": "GET \/v3\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/%2egit\/config",
"evidence_snippet": "GET \/v3\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_git_exposure",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /js/chunks/[chunk-name]%2e[hash]%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /js/chunks/[chunk-name]%2e[hash]%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/js/chunks/[chunk-name]%2e[hash]%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/js/chunks/[chunk-name]%2e[hash]%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /js/chunks/[chunk-name]%2e[hash]%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /js/chunks/[chunk-name]%2e[hash]%2ejs HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding:
Requête brute (extrait)
GET /js/chunks/[chunk-name]%2e[hash]%2ejs HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "bb00a71ad1ef998ff8c399652d37ea781c1c1a62",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 400,
"payload_entropy": 5.268239486197189,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "fa86433dc4df83046f09e7759c46e6512cecb207",
"event_fingerprint": "d0ec5cd468049a1121e9b3c65f06ef722e8605bd",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "368e59ce1aa297be2b1d25b380b3f494",
"path_pattern_hash": "6356dc43abb375ebfef2a82420869a1e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding:",
"method": "GET",
"path": "\/js\/chunks\/[chunk-name]%2e[hash]%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1",
"request_sample": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-",
"payload_snippet": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding:",
"evidence": {
"method": "GET",
"path": "\/js\/chunks\/[chunk-name]%2e[hash]%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1",
"request_sample": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-",
"payload_snippet": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding:",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f505521a98c9d89808cc96cac7be1f219bbadc02",
"protocol_details": {
"http_method": "GET",
"http_path": "\/js\/chunks\/[chunk-name]%2e[hash]%2ejs",
"request_line": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding:",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js\/chunks\/[chunk-name]%2e[hash]%2ejs",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/js\/chunks\/[chunk-name]%2e[hash]%2ejs",
"request_line": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js\/chunks\/[chunk-name]%2e[hash]%2ejs",
"evidence_snippet": "GET \/js\/chunks\/[chunk-name]%2e[hash]%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding:",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /app/netlify%2etoml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/netlify%2etoml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/app/netlify%2etoml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/app/netlify%2etoml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /app/netlify%2etoml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /app/netlify%2etoml HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /app/netlify%2etoml HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "37434dba46d3c73a92f0d2cc4062402343a8386c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.183994495537642,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "ee862b21f629ca34e53ecf454fb74c31df60024f",
"event_fingerprint": "b3a885a7ae2e184802f916f1596724d2e9461dae",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "553b2aec6e465e0b3f074f1680cff41d",
"path_pattern_hash": "006cc4ce53702b488703ca5f48b92a37"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/app\/netlify%2etoml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/netlify%2etoml HTTP\/1.1",
"request_sample": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/app\/netlify%2etoml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/netlify%2etoml HTTP\/1.1",
"request_sample": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "684700a11e15cf1e535e0b5eb3bd3f5bc6237d38",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/netlify%2etoml",
"request_line": "GET \/app\/netlify%2etoml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/netlify%2etoml",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/netlify%2etoml",
"request_line": "GET \/app\/netlify%2etoml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/netlify%2etoml",
"evidence_snippet": "GET \/app\/netlify%2etoml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /saml/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /saml/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/saml/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/saml/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /saml/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /saml/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /saml/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "5a30af9bec3ff0d35daf72a5746572d15f0917b4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.166864828134419,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "e406d1b9eff84c1d0aacae5729ed6c2c60b2e911",
"event_fingerprint": "68f221e0c9424cb2ac98e9bf9f0e303c7c7cd1fe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "42b1c8086f0e0284d9f6335af22da5fb",
"path_pattern_hash": "2d6ec9446b97519ae97d329c2cef5282"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/saml\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/saml\/%2eenv HTTP\/1.1",
"request_sample": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/saml\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/saml\/%2eenv HTTP\/1.1",
"request_sample": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62179c845258ba4f5aaacc715d6145f933d30151",
"protocol_details": {
"http_method": "GET",
"http_path": "\/saml\/%2eenv",
"request_line": "GET \/saml\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/saml\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/saml\/%2eenv",
"request_line": "GET \/saml\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/saml\/%2eenv",
"evidence_snippet": "GET \/saml\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_saml",
"http_saml_probe",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /pUbLiC/%2eeNv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /pUbLiC/%2eeNv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/pUbLiC/%2eeNv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/pUbLiC/%2eeNv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /pUbLiC/%2eeNv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /pUbLiC/%2eeNv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /pUbLiC/%2eeNv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "17fe632bf17b1cbac58bee5a4a6a61b0de546e16",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.1927922231512085,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "54e0304fcee9081a876df37bc2be581031a83912",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "67f31ba18301087f990594f0ba952d17",
"path_pattern_hash": "cfc7047faaf170b6eb1a835f432ccc32"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/pUbLiC\/%2eeNv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/pUbLiC\/%2eeNv HTTP\/1.1",
"request_sample": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/pUbLiC\/%2eeNv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/pUbLiC\/%2eeNv HTTP\/1.1",
"request_sample": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33a44c83efe450a0dc3533126c9869c24c33b13a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/pUbLiC\/%2eeNv",
"request_line": "GET \/pUbLiC\/%2eeNv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/pUbLiC\/%2eeNv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/pUbLiC\/%2eeNv",
"request_line": "GET \/pUbLiC\/%2eeNv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/pUbLiC\/%2eeNv",
"evidence_snippet": "GET \/pUbLiC\/%2eeNv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /secrets%2eyml~
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /secrets%2eyml~ UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/secrets%2eyml~
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/secrets%2eyml~
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /secrets%2eyml~ HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /secrets%2eyml~ HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /secrets%2eyml~ HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b02e104d35bdfc230dabb7a42b417c5fbb39bd9b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.17528505216188,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "258bce845c73d502b9539f2693b2c2893fd54fec",
"event_fingerprint": "9c296e23362ea87353001bd1d3d397ac968c1d99",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a3e963ae24c1157bf44e8eb65c4bb488",
"path_pattern_hash": "4ba0a648a384366584187755a8b07da3"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/secrets%2eyml~",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/secrets%2eyml~ HTTP\/1.1",
"request_sample": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/secrets%2eyml~",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/secrets%2eyml~ HTTP\/1.1",
"request_sample": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "022e0295e1ef76ff3af4e0db74b6b14a94133cad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets%2eyml~",
"request_line": "GET \/secrets%2eyml~ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets%2eyml~",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets%2eyml~",
"request_line": "GET \/secrets%2eyml~ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets%2eyml~",
"evidence_snippet": "GET \/secrets%2eyml~ HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_k8s_probe",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /cms/config%2exml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /cms/config%2exml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/cms/config%2exml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/cms/config%2exml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /cms/config%2exml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /cms/config%2exml HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /cms/config%2exml HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "6f49995d5a7c812ede67cad66e6e040db63fe0ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.191337544456956,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "28183e6f3d4d2f234411f09a977e9173a8381a66",
"event_fingerprint": "7e27d620d5bd7d2534c215d8c297bc59710b1075",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "adf80e9ed80c6308acc57f39b4705dd7",
"path_pattern_hash": "42b3dc174729ab119809bca110ba0631"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/cms\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cms\/config%2exml HTTP\/1.1",
"request_sample": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/cms\/config%2exml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cms\/config%2exml HTTP\/1.1",
"request_sample": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "120f886ead88313a39b671fcbe8b8908ee783cae",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cms\/config%2exml",
"request_line": "GET \/cms\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/config%2exml",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cms\/config%2exml",
"request_line": "GET \/cms\/config%2exml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/config%2exml",
"evidence_snippet": "GET \/cms\/config%2exml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /api/keys/db%2ephp
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/keys/db%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/keys/db%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/api/keys/db%2ephp
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/keys/db%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/keys/db%2ephp HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /api/keys/db%2ephp HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "f702b321024d6894eb323c4c5e2852aa92bbb5e6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.198895529471049,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "527711416648ff5363af8ef84185e202139c8b6d",
"event_fingerprint": "430767537507716d5acdea684164a584c72ca8c1",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dfbc3c9a82a222c66c56652b14a8d53d",
"path_pattern_hash": "62fbb277d57ea8fc8e9f9ef8cad121da"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/api\/keys\/db%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/keys\/db%2ephp HTTP\/1.1",
"request_sample": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/api\/keys\/db%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/keys\/db%2ephp HTTP\/1.1",
"request_sample": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d8c0287fcf81fb94168cf2113182fefc572c381",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/keys\/db%2ephp",
"request_line": "GET \/api\/keys\/db%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/keys\/db%2ephp",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/keys\/db%2ephp",
"request_line": "GET \/api\/keys\/db%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/keys\/db%2ephp",
"evidence_snippet": "GET \/api\/keys\/db%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /config/mail/mailgun%2eyaml
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/mail/mailgun%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/mail/mailgun%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/config/mail/mailgun%2eyaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/mail/mailgun%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/mail/mailgun%2eyaml HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acc
Requête brute (extrait)
GET /config/mail/mailgun%2eyaml HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "5575dca9cffc56f4ac3e24bae892588b2fb22a60",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 390,
"payload_entropy": 5.204863312168575,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "34e3ca1be78681610635664544878ce1c7a49ad6",
"event_fingerprint": "aecb73ca064e2566d8157e2251e14c57ce42ddec",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dd1d9f38c6c400c48ba0e173e351cbc0",
"path_pattern_hash": "851ce9526e0fb3fe1ee9f5611a1b7546"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"method": "GET",
"path": "\/config\/mail\/mailgun%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1",
"request_sample": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/config\/mail\/mailgun%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1",
"request_sample": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88fc765b7710307d4b383cb57507b72aed209081",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/mail\/mailgun%2eyaml",
"request_line": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/mail\/mailgun%2eyaml",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/mail\/mailgun%2eyaml",
"request_line": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/mail\/mailgun%2eyaml",
"evidence_snippet": "GET \/config\/mail\/mailgun%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /srv/www/%2eenv
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /srv/www/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/srv/www/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/srv/www/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /srv/www/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /srv/www/%2eenv HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /srv/www/%2eenv HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b9ec5296f2186674a107d37b310be2a3e0b561d7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.172323198834003,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "8e057031b95e5d794f9e80f1e8b8181d8aca1e82",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "bbd0dc74f601bc108515cd5a228b1b07",
"path_pattern_hash": "9e14fa45c12cb0a288e483de1ab3ba51"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/srv\/www\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/www\/%2eenv HTTP\/1.1",
"request_sample": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/srv\/www\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/www\/%2eenv HTTP\/1.1",
"request_sample": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f9c26911f6a3411601155172fa65156902d1733",
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/www\/%2eenv",
"request_line": "GET \/srv\/www\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/www\/%2eenv",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/www\/%2eenv",
"request_line": "GET \/srv\/www\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/www\/%2eenv",
"evidence_snippet": "GET \/srv\/www\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /database%2ezip
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /database%2ezip UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/database%2ezip
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/database%2ezip
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /database%2ezip HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /database%2ezip HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /database%2ezip HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "e271ccdff04831d8db463e17ed65b2888fa9227d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.161931530088138,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "edfac6f80dd93ad483f9f75861e415a1930fdb2d",
"event_fingerprint": "70e21b19927da87bf7de497783197536ef6ebd53",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "21cff49691461c63ac6a834ab10141f2",
"path_pattern_hash": "d77658c235183f0786b80fa801ab3da5"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/database%2ezip",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/database%2ezip HTTP\/1.1",
"request_sample": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/database%2ezip",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/database%2ezip HTTP\/1.1",
"request_sample": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6d06628b940bb8a47b1d99911bf33b37a0bd624",
"protocol_details": {
"http_method": "GET",
"http_path": "\/database%2ezip",
"request_line": "GET \/database%2ezip HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/database%2ezip",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/database%2ezip",
"request_line": "GET \/database%2ezip HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/database%2ezip",
"evidence_snippet": "GET \/database%2ezip HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /backup/config%2ejson
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /backup/config%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/backup/config%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/backup/config%2ejson
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backup/config%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /backup/config%2ejson HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /backup/config%2ejson HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "633b6b505e7fad1d4b8b4bc09342eb1e73b417d1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.1964111842191,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "bfd1ca2614f29b8be444ae952b0fcbc87271f4a8",
"event_fingerprint": "ee665b45768216a0ea3d28847a93953cbe936a56",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6e19e9248ec654eecb39971492dd4716",
"path_pattern_hash": "ff80d1b52cdea697ca2529f9f8817ae0"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/backup\/config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup\/config%2ejson HTTP\/1.1",
"request_sample": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/backup\/config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backup\/config%2ejson HTTP\/1.1",
"request_sample": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a41bc4c9ff9c864d1118258e7d30c4f06de44b7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup\/config%2ejson",
"request_line": "GET \/backup\/config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup\/config%2ejson",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup\/config%2ejson",
"request_line": "GET \/backup\/config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup\/config%2ejson",
"evidence_snippet": "GET \/backup\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_backup",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /demo/%2eenv%2eproduction
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /demo/%2eenv%2eproduction UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/demo/%2eenv%2eproduction
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/demo/%2eenv%2eproduction
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /demo/%2eenv%2eproduction HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /demo/%2eenv%2eproduction HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /demo/%2eenv%2eproduction HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "2fbdc9271af05e7413bfd9f97dea4eea1a96f959",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.174015224361282,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5f6dc76cd0a10ee7cae1a88973852db1c7b8eba4",
"event_fingerprint": "ff1f37571011696c3027b4b1dae7bccf9c9bcc4b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "9d95b63760065c7dc0c1c46635359a74",
"path_pattern_hash": "855f9015d6218643ce8515dc0d2ab80e"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/demo\/%2eenv%2eproduction",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1",
"request_sample": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/demo\/%2eenv%2eproduction",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1",
"request_sample": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "334f8a3b9b371c501107c6a084e3ec293e35de59",
"protocol_details": {
"http_method": "GET",
"http_path": "\/demo\/%2eenv%2eproduction",
"request_line": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/demo\/%2eenv%2eproduction",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/demo\/%2eenv%2eproduction",
"request_line": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/demo\/%2eenv%2eproduction",
"evidence_snippet": "GET \/demo\/%2eenv%2eproduction HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8042 · (tentative d'exploit) · → /%2eenv%2etravis
|
Élevée
|
Élevé · 80
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eenv%2etravis UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950514:leak-1
951041:dns-rebind
Cible HTTP
GET
/%2eenv%2etravis
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/%2eenv%2etravis
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eenv%2etravis HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eenv%2etravis HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /%2eenv%2etravis HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "a1c562326b1419b2b00c8d616c70996df2926d1f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.160267339775212,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "50bdd7ff82b763929032d1d96f28326286927bfe",
"event_fingerprint": "d2c0b911432cfae167d0d809ff351acd1e32b843",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e5c6c29f6928bdf4bf043f87179263a3",
"path_pattern_hash": "6be17bf36d1fb0823f32b6a7386e61d1"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/%2eenv%2etravis",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2etravis HTTP\/1.1",
"request_sample": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/%2eenv%2etravis",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2etravis HTTP\/1.1",
"request_sample": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46bdf174dc540be1ef64d996f9ff15d4cb8303bf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2etravis",
"request_line": "GET \/%2eenv%2etravis HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2etravis",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2etravis",
"request_line": "GET \/%2eenv%2etravis HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2etravis",
"evidence_snippet": "GET \/%2eenv%2etravis HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /config/health%2ejs
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/health%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/health%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/config/health%2ejs
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/health%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/health%2ejs HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /config/health%2ejs HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "4ff6547188587857d56e431cb2554169fbece943",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.1904187541822955,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "34e3ca1be78681610635664544878ce1c7a49ad6",
"event_fingerprint": "54e597c25cc4a2edf6dcf584c1ef4ba153ca92a9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "153e7b445369ea340d5deddbaf363f02",
"path_pattern_hash": "bbdfca5a78c3f59cb097776f76bbe01c"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/config\/health%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/health%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/config\/health%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/health%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3301f8ac427d5c765b6afb2df1d15047da8a423c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/health%2ejs",
"request_line": "GET \/config\/health%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/health%2ejs",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/health%2ejs",
"request_line": "GET \/config\/health%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/health%2ejs",
"evidence_snippet": "GET \/config\/health%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /*%2eenv%2esample%2ebackup
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /*%2eenv%2esample%2ebackup UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/*%2eenv%2esample%2ebackup
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/*%2eenv%2esample%2ebackup
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /*%2eenv%2esample%2ebackup HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /*%2eenv%2esample%2ebackup HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /*%2eenv%2esample%2ebackup HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "b4e6f3e3075a66d053152065bcf0933436848778",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.202106983789221,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "2a3d5f9098719650dabcac860085406b1a75250a",
"event_fingerprint": "95caa07683d65d4b2151d9f7fa9969e995ed7186",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e4181130be0a8e4628d8c9d214308720",
"path_pattern_hash": "b76b0daaebb17550ae6ecfc10ac48ce5"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/*%2eenv%2esample%2ebackup",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1",
"request_sample": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/*%2eenv%2esample%2ebackup",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1",
"request_sample": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bad58437842df5d3e2fbc0515a7ec439be7691cb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/*%2eenv%2esample%2ebackup",
"request_line": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/*%2eenv%2esample%2ebackup",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/*%2eenv%2esample%2ebackup",
"request_line": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/*%2eenv%2esample%2ebackup",
"evidence_snippet": "GET \/*%2eenv%2esample%2ebackup HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8042 · HTTP
|
http
|
Flood / DDoS
http flood · via HTTP:8042 · (tentative d'exploit) · → /mailer%2eini%2ebak
|
Élevée
|
Élevé · 82
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /mailer%2eini%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950521:leak-8
951041:dns-rebind
Cible HTTP
GET
/mailer%2eini%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8042
Chemin / cible
/mailer%2eini%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /mailer%2eini%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /mailer%2eini%2ebak HTTP/1.1
Host: 62.3.50.33:8042
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /mailer%2eini%2ebak HTTP/1.1 Host: 62.3.50.33:8042 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "19d8f233936e6b4ecaa205cdb04bfdaf9d394908",
"http_target_hash": "4d76360e4e3014552fbf89282ed164445682595c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.173357317936081,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "IT",
"dst_port": 8042,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 82,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "ddf9e4cdb9d29ed2a1d12b8b7c200b5befdb4788",
"event_fingerprint": "73198bd86b98ce2763422b6d82fc6e321ccb34a6",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "IT",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e6bda233bd2d082e328ba0fa630cb72f",
"path_pattern_hash": "fbaa208e88d6326b61e7e7079f8c48fa"
},
"target_context": {
"dst_port": 8042,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/mailer%2eini%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mailer%2eini%2ebak HTTP\/1.1",
"request_sample": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/mailer%2eini%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mailer%2eini%2ebak HTTP\/1.1",
"request_sample": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "558e8c273be44b9f2981b222f8a0a4b1a47b3ba0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer%2eini%2ebak",
"request_line": "GET \/mailer%2eini%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer%2eini%2ebak",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8042,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer%2eini%2ebak",
"request_line": "GET \/mailer%2eini%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8042,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8042 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer%2eini%2ebak",
"evidence_snippet": "GET \/mailer%2eini%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:8042\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "8042 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|