27/07/2026 01:31:28 UTC
TCP
10255 · HTTP
Cross-site scripting
xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /logs/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_logs
Cible HTTP
GET
/logs/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/logs/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /logs/ HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /logs/ HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (K
Requête brute (extrait)
GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1560e35decbcf1542ae720d76e3937642edcc47f",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 446,
"payload_entropy": 5.454709896016729,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 84,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 84,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d",
"event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 84,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "31c1a326621a7a378f2472b975f86680",
"payload_hash": "04fcb0da663856370e3ccdc26fd5ab69",
"path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K",
"method": "GET",
"path": "\/logs\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/logs\/ HTTP\/1.1",
"request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K",
"evidence": {
"method": "GET",
"path": "\/logs\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/logs\/ HTTP\/1.1",
"request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w",
"payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6b8000f5a0cc7d49e8ea00a421c7a9c41d7e70b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/logs\/",
"request_line": "GET \/logs\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K",
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 84,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/logs\/",
"request_line": "GET \/logs\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/",
"evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_logs",
"net_web_probe"
]
}
27/07/2026 01:31:20 UTC
TCP
10255 · HTTP
Sonde Prometheus
prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics
Élevée
Moyen · 49
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /metrics UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950601:k8s-metrics
950610:prometheus-metrics
Cible HTTP
GET
/metrics
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/metrics
Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 49
Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
Sonde métriques Prometheus
Upstream
Tag WAF SQLi (métriques)
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 941130
Probe /metrics
Ligne de requête
GET /metrics HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-metrics
prometheus-metrics
Payload (extrait)
GET /metrics HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K
Requête brute (extrait)
GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020",
"emulator_response_len": 154,
"http_header_count": 12,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "f5a33d0f730ef5dfbb1133b1daf97081b118f0f8",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 582,
"payload_entropy": 5.543087193031319,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 84,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 49,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7",
"event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c",
"classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 87,
"precision_signals": [
"INT-benign-metrics",
"INT-upstream",
"INT-sqli-tag-only-metrics"
],
"kb_rule_ids": [
"INT-benign-metrics",
"INT-upstream",
"INT-sqli-tag-only-metrics"
],
"matched_patterns": [
"pat-0284",
"pat-0266"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/metrics"
],
"pattern_ids": [
"pat-0284",
"pat-0266"
],
"confidence_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 49,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6f0b00a9b7c9a0af5650063bab11579c",
"payload_hash": "bb44b3ecf9cfd612135b7adbcc6b1e00",
"path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"method": "GET",
"path": "\/metrics",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950601:k8s-metrics",
"950610:prometheus-metrics"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-metrics",
"prometheus-metrics"
],
"request_line": "GET \/metrics HTTP\/1.1",
"request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image",
"payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"evidence": {
"method": "GET",
"path": "\/metrics",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950601:k8s-metrics",
"950610:prometheus-metrics"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-metrics",
"prometheus-metrics"
],
"request_line": "GET \/metrics HTTP\/1.1",
"request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image",
"payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "018ef10f815d809a7e1682fe707bd51d68c88575",
"protocol_details": {
"http_method": "GET",
"http_path": "\/metrics",
"request_line": "GET \/metrics HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 49,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"INT-benign-metrics",
"INT-upstream",
"INT-sqli-tag-only-metrics"
],
"tags_summary_labels_fr": [
"Sonde m\u00e9triques Prometheus",
"Upstream",
"Tag WAF SQLi (m\u00e9triques)"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/metrics",
"request_line": "GET \/metrics HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics",
"evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950601:k8s-metrics",
"950610:prometheus-metrics",
"http_probe_metrics",
"http_prometheus_probe",
"net_web_probe"
]
}
27/07/2026 01:31:08 UTC
TCP
10255 · HTTP
Cross-site scripting
xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz
Élevée
Moyen · 42
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /configz UA Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/configz
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/configz
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /configz HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /configz HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,i
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 12,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fbc0a46f9c2e144fc770fef4de21ffe725652a28",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 589,
"payload_entropy": 5.548015734224202,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 60,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1",
"event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6273f9be1b02ca05f8b0ec5ce5b17279",
"payload_hash": "d6a3fc0ee4cb4deec70fb1a475da6ea7",
"path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"method": "GET",
"path": "\/configz",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/configz HTTP\/1.1",
"request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i",
"payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"evidence": {
"method": "GET",
"path": "\/configz",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/configz HTTP\/1.1",
"request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i",
"payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86fa4b49690a975d5542bd92e322cc7ef980fc18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configz",
"request_line": "GET \/configz HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configz",
"request_line": "GET \/configz HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz",
"evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
27/07/2026 01:31:05 UTC
TCP
10255 · HTTP
Cross-site scripting
xss attack · via HTTP:10255 · (tentative d'exploit) · → /runningpods
Élevée
Moyen · 42
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /runningpods UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/runningpods
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/runningpods
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /runningpods HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /runningpods HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/2010010
Requête brute (extrait)
GET /runningpods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Encoding:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "b537a727b7efcfbf59f3097a4594fe49e8499b9b",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "508e8abfed1d40704fac5584e007c20acacd346d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 421,
"payload_entropy": 5.421668568278858,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 60,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1",
"event_fingerprint": "aae964e5bf78414b19869a93009c9c4135d8294f",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a94861fc8a38a05a7f29da11bd6b4b4f",
"payload_hash": "b802923d7ffbf4cdcdfcbbdf78facc91",
"path_pattern_hash": "c68f62b038ea85a87c5303e54ee293de"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/2010010",
"method": "GET",
"path": "\/runningpods",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/runningpods HTTP\/1.1",
"request_sample": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encoding:",
"payload_snippet": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/2010010",
"evidence": {
"method": "GET",
"path": "\/runningpods",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/runningpods HTTP\/1.1",
"request_sample": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAccept-Encoding:",
"payload_snippet": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/2010010",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71be6923fc8a80b82bc80fbfcc47e65df7f419eb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/runningpods",
"request_line": "GET \/runningpods HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/2010010",
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/runningpods",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/runningpods",
"request_line": "GET \/runningpods HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/runningpods",
"evidence_snippet": "GET \/runningpods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/2010010",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
27/07/2026 01:30:49 UTC
TCP
10255 · KUBELET READONLY
Sonde Kafka
kafka probe · via KUBELET READONLY:10255 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KUBELET-READONLY
WAF
—
Recommandation
Surveiller
Tags
kubernetes_probe
net_kubernetes_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
10255
Chemin / cible
—
Service
KUBELET READONLY
Payload
�E�� .A��6E"�b�/� �ʴ���:�� Z\^�ʹ��;@-��9npC����8>��?G)˰ ���+�/�,�0̨̩�� � � / 5 � �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�E�� .A��6E"�b�/� �ʴ���:�� Z\^�ʹ��;@-��9npC����8>��?G)˰ ���+�/�,�0̨̩�� � � / 5 �
�
Requête brute (extrait)
�E�� .A��6E"�b�/� �ʴ���:�� Z\^�ʹ��;@-��9npC����8>��?G)˰ ���+�/�,�0̨̩�� � � / 5 � � # h2http/1.1 3 + ) �y��F��v����'�9c�"�� O\(�]`y -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.761004305697033,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "kubelet-readonly",
"app_proto": "kubelet-readonly",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db",
"event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "kubelet-readonly",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "74a60a2f9d780f87abb1f6deaa00b086",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 10255,
"service": "kubelet-readonly",
"service_name": "kubelet-readonly",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015E\ufffd\ufffd\u000b.\u0014A\ufffd\ufffd\b6E\u0016\u0015\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\u0003\ufffd:\ufffd\ufffd \u0015Z\\^\ufffd\u02b9\ufffd\ufffd;@\u0002-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015E\ufffd\ufffd\u000b.\u0014A\ufffd\ufffd\b6E\u0016\u0015\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\u0003\ufffd:\ufffd\ufffd \u0015Z\\^\ufffd\u02b9\ufffd\ufffd;@\u0002-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\n\n\u0000\u0001\u0000\u0000\u001d\u0000 \ufffdy\ufffd\u0017\ufffdF\ufffd\ufffdv\u0004\ufffd\ufffd\ufffd\ufffd'\ufffd9c\ufffd\u0005\u0015\"\ufffd\ufffd\tO\\(\ufffd]`y\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015E\ufffd\ufffd\u000b.\u0014A\ufffd\ufffd\b6E\u0016\u0015\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\u0003\ufffd:\ufffd\ufffd \u0015Z\\^\ufffd\u02b9\ufffd\ufffd;@\u0002-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c74c4e5beba527ac06ca0b88055f0ffc7b81c088",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015E\ufffd\ufffd\u000b.\u0014A\ufffd\ufffd\b6E\u0016\u0015\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\u0003\ufffd:\ufffd\ufffd \u0015Z\\^\ufffd\u02b9\ufffd\ufffd;@\u0002-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"evidence_snippet": "\ufffdE\ufffd\ufffd.A\ufffd\ufffd6E\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\ufffd:\ufffd\ufffd Z\\^\ufffd\u02b9\ufffd\ufffd;@-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\n\n\ufffd",
"attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kubelet-readonly",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0015E\ufffd\ufffd\u000b.\u0014A\ufffd\ufffd\b6E\u0016\u0015\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\u0003\ufffd:\ufffd\ufffd \u0015Z\\^\ufffd\u02b9\ufffd\ufffd;@\u0002-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\n\n\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdE\ufffd\ufffd.A\ufffd\ufffd6E\"\ufffdb\ufffd\/\ufffd\t\ufffd\u02b4\ufffd\ufffd\ufffd:\ufffd\ufffd Z\\^\ufffd\u02b9\ufffd\ufffd;@-\ufffd\ufffd9npC\ufffd\ufffd\ufffd\ufffd8>\ufffd\ufffd?G)\u02f0 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\n\n\ufffd",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kubelet_readonly",
"service_banner": "honeypot-kubelet-readonly",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
]
}
27/07/2026 01:30:46 UTC
TCP
10255 · KUBELET READONLY
Sonde Kafka
kafka probe · via KUBELET READONLY:10255 · (sonde / probe)
Élevée
Faible · 32
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KUBELET-READONLY
WAF
—
Recommandation
Surveiller
Tags
kubernetes_probe
net_kubernetes_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
10255
Chemin / cible
—
Service
KUBELET READONLY
Payload
�$C�;���Ha�4�#�9E~L����Htq1w� �c�xl�2��ip ��g�7r �k��g/� "� jj�+�/�,�0̨̩�� � � / 5 ��� �
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0556
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kafka ApiVersions key
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�$C�;���Ha�4�#�9E~L����Htq1w� �c�xl�2��ip ��g�7r �k��g/� "� jj�+�/�,�0̨̩�� � � / 5 ��� �
Requête brute (extrait)
�$C�;���Ha�4�#�9E~L����Htq1w� �c�xl�2��ip ��g�7r �k��g/� "� jj�+�/�,�0̨̩�� � � / 5 ��� � �� # h2http/1.1 3 + )�� ��c�� {�e����� a�І��aɊW�u�^ -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.7725688642511144,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "kubelet-readonly",
"app_proto": "kubelet-readonly",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db",
"event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"pat-0556"
],
"kb_rule_ids": [
"pat-0556"
],
"matched_patterns": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Kafka ApiVersions key",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0556",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"named_classification_skipped": false,
"service_name": "kubelet-readonly",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "822e4433b206a336f093214f7b6c19e8",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 10255,
"service": "kubelet-readonly",
"service_name": "kubelet-readonly",
"risk_score": 32
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$C\ufffd;\ufffd\ufffd\ufffdHa\u000e\ufffd4\ufffd#\ufffd9E~L\u0018\ufffd\u0013\ufffd\ufffd\ufffdHtq1w\ufffd \u001b\ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\u001c\ufffd\ufffdg\ufffd7r\f\ufffdk\ufffd\ufffdg\u0001\/\ufffd\f\"\ufffd\u000e\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$C\ufffd;\ufffd\ufffd\ufffdHa\u000e\ufffd4\ufffd#\ufffd9E~L\u0018\ufffd\u0013\ufffd\ufffd\ufffdHtq1w\ufffd \u001b\ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\u001c\ufffd\ufffdg\ufffd7r\f\ufffdk\ufffd\ufffdg\u0001\/\ufffd\f\"\ufffd\u000e\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffdc\ufffd\ufffd\n\u001e{\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\u0000a\ufffd\u0406\ufffd\ufffd\u0002a\u024aW\ufffdu\ufffd^\u0000-\u0000\u0002\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$C\ufffd;\ufffd\ufffd\ufffdHa\u000e\ufffd4\ufffd#\ufffd9E~L\u0018\ufffd\u0013\ufffd\ufffd\ufffdHtq1w\ufffd \u001b\ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\u001c\ufffd\ufffdg\ufffd7r\f\ufffdk\ufffd\ufffdg\u0001\/\ufffd\f\"\ufffd\u000e\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b4418e5024119b8bcea3d5dfe803a3dc4bdc7a4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$C\ufffd;\ufffd\ufffd\ufffdHa\u000e\ufffd4\ufffd#\ufffd9E~L\u0018\ufffd\u0013\ufffd\ufffd\ufffdHtq1w\ufffd \u001b\ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\u001c\ufffd\ufffdg\ufffd7r\f\ufffdk\ufffd\ufffdg\u0001\/\ufffd\f\"\ufffd\u000e\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"evidence_snippet": "\ufffd$C\ufffd;\ufffd\ufffd\ufffdHa\ufffd4\ufffd#\ufffd9E~L\ufffd\ufffd\ufffd\ufffdHtq1w\ufffd \ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\ufffd\ufffdg\ufffd7r\ufffdk\ufffd\ufffdg\/\ufffd\"\ufffd jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0556"
],
"tags_summary_labels_fr": [
"pat-0556"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kubelet-readonly",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003$C\ufffd;\ufffd\ufffd\ufffdHa\u000e\ufffd4\ufffd#\ufffd9E~L\u0018\ufffd\u0013\ufffd\ufffd\ufffdHtq1w\ufffd \u001b\ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\u001c\ufffd\ufffdg\ufffd7r\f\ufffdk\ufffd\ufffdg\u0001\/\ufffd\f\"\ufffd\u000e\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd$C\ufffd;\ufffd\ufffd\ufffdHa\ufffd4\ufffd#\ufffd9E~L\ufffd\ufffd\ufffd\ufffdHtq1w\ufffd \ufffdc\ufffdxl\ufffd2\ufffd\ufffdip\ufffd\ufffdg\ufffd7r\ufffdk\ufffd\ufffdg\/\ufffd\"\ufffd jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kubelet_readonly",
"service_banner": "honeypot-kubelet-readonly",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
]
}
26/07/2026 05:47:18 UTC
TCP
10255 · HTTP
Cross-site scripting
xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /logs/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_logs
Cible HTTP
GET
/logs/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/logs/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /logs/ HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /logs/ HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTM
Requête brute (extrait)
GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "407efa38f347fdc7bcf4ad30f1ca4db656fa89c4",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 443,
"payload_entropy": 5.454780496087243,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 84,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 84,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d",
"event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 84,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c487aa740d1f3628447382b2b1bf90f3",
"payload_hash": "d29d94eac3e176ae5c4315f07baccfdb",
"path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM",
"method": "GET",
"path": "\/logs\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/logs\/ HTTP\/1.1",
"request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp",
"payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM",
"evidence": {
"method": "GET",
"path": "\/logs\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/logs\/ HTTP\/1.1",
"request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp",
"payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e682e2373df99ef776dc5f440dd938aba87e1a2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/logs\/",
"request_line": "GET \/logs\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM",
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 84,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/logs\/",
"request_line": "GET \/logs\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/",
"evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_logs",
"net_web_probe"
]
}
26/07/2026 05:47:16 UTC
TCP
10255 · HTTP
Sonde Prometheus
prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics
Élevée
Moyen · 49
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /metrics UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950601:k8s-metrics
950610:prometheus-metrics
Cible HTTP
GET
/metrics
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/metrics
Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 49
Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
Sonde métriques Prometheus
Upstream
Tag WAF SQLi (métriques)
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 941130
Probe /metrics
Ligne de requête
GET /metrics HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-metrics
prometheus-metrics
Payload (extrait)
GET /metrics HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020",
"emulator_response_len": 154,
"http_header_count": 12,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 578,
"payload_entropy": 5.560138866251807,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 84,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 49,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7",
"event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c",
"classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 87,
"precision_signals": [
"INT-benign-metrics",
"INT-upstream",
"INT-sqli-tag-only-metrics"
],
"kb_rule_ids": [
"INT-benign-metrics",
"INT-upstream",
"INT-sqli-tag-only-metrics"
],
"matched_patterns": [
"pat-0284",
"pat-0266"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/metrics"
],
"pattern_ids": [
"pat-0284",
"pat-0266"
],
"confidence_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 49,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f",
"payload_hash": "b1b3d53295d2e84777fee5b31b688eb3",
"path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ",
"method": "GET",
"path": "\/metrics",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950601:k8s-metrics",
"950610:prometheus-metrics"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-metrics",
"prometheus-metrics"
],
"request_line": "GET \/metrics HTTP\/1.1",
"request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,",
"payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/metrics",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950601:k8s-metrics",
"950610:prometheus-metrics"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-metrics",
"prometheus-metrics"
],
"request_line": "GET \/metrics HTTP\/1.1",
"request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,",
"payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "365a8b1285cc579384658c10e425a8012a0d00ae",
"protocol_details": {
"http_method": "GET",
"http_path": "\/metrics",
"request_line": "GET \/metrics HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 49,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"INT-benign-metrics",
"INT-upstream",
"INT-sqli-tag-only-metrics"
],
"tags_summary_labels_fr": [
"Sonde m\u00e9triques Prometheus",
"Upstream",
"Tag WAF SQLi (m\u00e9triques)"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/metrics",
"request_line": "GET \/metrics HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics",
"evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950601:k8s-metrics",
"950610:prometheus-metrics",
"http_probe_metrics",
"http_prometheus_probe",
"net_web_probe"
]
}
26/07/2026 05:47:13 UTC
TCP
10255 · HTTP
Cross-site scripting
xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz
Élevée
Moyen · 42
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /configz UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/configz
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/configz
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1 Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /configz HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /configz HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15
Requête brute (extrait)
GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1560e35decbcf1542ae720d76e3937642edcc47f",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 448,
"payload_entropy": 5.457895462057103,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 60,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1",
"event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "31c1a326621a7a378f2472b975f86680",
"payload_hash": "0d424ecacd43b11f22b8c2ce83447b72",
"path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 ",
"method": "GET",
"path": "\/configz",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/configz HTTP\/1.1",
"request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image",
"payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"evidence": {
"method": "GET",
"path": "\/configz",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/configz HTTP\/1.1",
"request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image",
"payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a600b39b2bc4604df8f41af90f33e19613069520",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configz",
"request_line": "GET \/configz HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 60,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configz",
"request_line": "GET \/configz HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz",
"evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
26/07/2026 05:47:10 UTC
TCP
10255 · HTTP
Sonde Kubernetes API
kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods
Élevée
Moyen · 41
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /pods UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/pods
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/pods
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 41
Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1 Signaux
pat-0653
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Kubelet pods
CRS 941130
Ligne de requête
GET /pods HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /pods HTTP/1.1
Host: 62.3.50.33:10255
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik
Requête brute (extrait)
GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 12,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0630b87aaa3e749af3eb1147feb5ee67126097fa",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 590,
"payload_entropy": 5.570389135448552,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "http",
"app_proto": "http",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 60,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 60,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1",
"event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 74,
"precision_signals": [
"pat-0653"
],
"kb_rule_ids": [
"pat-0653"
],
"matched_patterns": [
"pat-0653",
"pat-0284"
],
"matched_pattern_names": [
"Kubelet pods",
"CRS 941130"
],
"pattern_ids": [
"pat-0653",
"pat-0284"
],
"confidence_breakdown": {
"waf": 60,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 41,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "96c65b69f70dd4c1e9b6e8398497708c",
"payload_hash": "871a8792770933029973ba3e0f49fb40",
"path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 41
},
"payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik",
"method": "GET",
"path": "\/pods",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/pods HTTP\/1.1",
"request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,",
"payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik",
"evidence": {
"method": "GET",
"path": "\/pods",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/pods HTTP\/1.1",
"request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,",
"payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99c9b1d08f61570458f8058be86bd8c31f6d5eba",
"protocol_details": {
"http_method": "GET",
"http_path": "\/pods",
"request_line": "GET \/pods HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135\u2026",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik",
"attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 41,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0653"
],
"tags_summary_labels_fr": [
"pat-0653"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/pods",
"request_line": "GET \/pods HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135\u2026",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods",
"evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kubelet-readonly"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
26/07/2026 05:47:07 UTC
TCP
10255 · KUBELET READONLY
Sonde Kubernetes API
kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KUBELET-READONLY
WAF
—
Recommandation
Surveiller
Tags
kubernetes_probe
net_kubernetes_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
10255
Chemin / cible
—
Service
KUBELET READONLY
Payload
�˹�jW� d�(eh|�Wv_���){�L@P �s y@l���H_��o\�S��Ah"����� �0=�� ���+�/�,�0̨̩�� � � / 5 ��� 3��zz
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�˹�jW�
d�(eh|�Wv_���){�L@P �s y@l���H_��o\�S��Ah"����� �0=�� ���+�/�,�0̨̩�� � � / 5 ��� 3��zz
Requête brute (extrait)
�˹�jW� d�(eh|�Wv_���){�L@P �s y@l���H_��o\�S��Ah"����� �0=�� ���+�/�,�0̨̩�� � � / 5 ��� 3��zz �� {����H{���k�f � �?1�ZD���9# =���m�A f�e"@n�� �} �8�6۠����㘷�� e����"<R㶍���^� �����+>4`L���@e�����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1797,
"payload_entropy": 7.7840789829883175,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "kubelet-readonly",
"app_proto": "kubelet-readonly",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db",
"event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kubelet-readonly",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d230391d65beebfef3091bcb6b466a38",
"path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
},
"target_context": {
"dst_port": 10255,
"service": "kubelet-readonly",
"service_name": "kubelet-readonly",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001\u0000\u0011\ufffd\u0004\ufffd\u001c{\ufffd\ufffd\ufffd\ufffdH{\ufffd\ufffd\u0014\ufffd\u0010k\b\ufffdf\u001e\ufffd\f\ufffd?1\ufffdZD\ufffd\ufffd\ufffd\u00049\u0003#\u0000=\u0002\ufffd\ufffd\ufffdm\ufffdA\u001cf\ufffde\"@n\ufffd\ufffd\r\ufffd}\u001d\ufffd8\u001a\ufffd6\u06e0\ufffd\ufffd\ufffd\u0018\ufffd\u3637\ufffd\ufffd\te\u0004\ufffd\ufffd\ufffd\ufffd\"<R\u3d8d\ufffd\u0002\ufffd\ufffd^\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u001b+>4`L\u0001\u0002\ufffd\ufffd\ufffd@e\ufffd\ufffd\ufffd\ud9ef\udcf0\u0010\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "099f6f8433f3bbed71b21f2555c4aed7ed1e030c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"evidence_snippet": "\ufffd\u02f9\ufffdjW\ufffd\rd\ufffd(eh|\ufffdWv_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0=\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd3\ufffd\ufffdzz",
"attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kubelet-readonly",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\u02f9\ufffdjW\ufffd\rd\ufffd(eh|\ufffdWv_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0=\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd3\ufffd\ufffdzz",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kubelet_readonly",
"service_banner": "honeypot-kubelet-readonly",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
]
}
26/07/2026 05:47:04 UTC
TCP
10255 · KUBELET READONLY
Sonde Kubernetes API
kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KUBELET-READONLY
WAF
—
Recommandation
Surveiller
Tags
kubernetes_probe
net_kubernetes_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
10255
Chemin / cible
—
Service
KUBELET READONLY
Payload
��b+�:<:��9߯H���m,� �iǺɋs&�� ��~Tv�'~"��1��Z5R�kuZ˫D���mz�b * �,�+̩�0�/̨� � �� � � 5 /�� �zz
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��b+�:<:��9߯H���m,� �iǺɋs&�� ��~Tv�'~"��1��Z5R�kuZ˫D���mz�b *
�,�+̩�0�/̨�
� �� � � 5 /��
�zz
Requête brute (extrait)
��b+�:<:��9߯H���m,� �iǺɋs&�� ��~Tv�'~"��1��Z5R�kuZ˫D���mz�b * �,�+̩�0�/̨� � �� � � 5 /�� �zz � �� h2http/1.1 3 + )�� ���W:0C)� ��H�Q7�;�TΪ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 517,
"payload_entropy": 3.947314966749976,
"port_category": "registered",
"org": "B2 Net Solutions Inc.",
"service": "kubelet-readonly",
"app_proto": "kubelet-readonly",
"asn": 55286,
"country": "US",
"dst_port": 10255,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db",
"event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "kubelet-readonly",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 55286,
"org": "B2 Net Solutions Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e11385fad808d8df220d8e26b3893464",
"path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
},
"target_context": {
"dst_port": 10255,
"service": "kubelet-readonly",
"service_name": "kubelet-readonly",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffd\ufffdW:\u000f0C)\ufffd\u0000\ufffd\ufffdH\ufffdQ7\ufffd;\ufffdT\u03aa",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56ad130287f8ca8fdacd0f5a39e7a4d35fc4a2b8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"evidence_snippet": "\ufffd\ufffdb+\ufffd:<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffdkuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb*\n\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffdzz",
"attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kubelet-readonly",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000*\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000",
"port": 10255,
"service": "kubelet-readonly",
"service_label_fr": "KUBELET READONLY"
},
"attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdb+\ufffd:<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffdkuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb*\n\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffdzz",
"target_port_label": "10255 \u00b7 KUBELET READONLY",
"emulator_service": "kubelet-readonly",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kubelet_readonly",
"service_banner": "honeypot-kubelet-readonly",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
]
}